Cloud Security Podcast
Episodes About Subscribe Voices Topics

Cloud Security Podcast

Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!

cloud-security-podcast_high_res.png

Episode list

#89
October 12, 2022

Next Special - Can We Escape Ransomware by Migrating to the Cloud?

Guest:

  • Nelly Kassem, Security and Compliance Specialist @ Google Cloud
25:25

Topics covered:

  • Why did ransomware attacks become so popular?
  • What type of organizations are targeted by ransomware?  Do these affect mostly the organizations with sub-par security?
  • Ransomware has been raging since 2015 and shows few signs of subsiding. Why are these attacks still successful? 
  • Do we see ransomware in the cloud? 
  • Does migrating to the cloud protect you from ransomware?
  • Which of Google Cloud tools are useful to fight ransomware?

Resources:

Read More
#88
October 11, 2022

Next Special - Improving Browser Security in the New Era of Work

Guest:

25:25

Topics covered:

  • What is browser security? Isn’t it just application security by another name? 
  • Why is browser security more important now than ever? 
  • Do we have statistical measures or data that tell us if we’re succeeding at browser security? Do we know if we’re doing a good job at making this better? 
  • What are the components of modern browser security? 
  • How does this work with an enterprise’s existing stack? 
  • In fact, how does this work with the rest of Google’s tooling, such as BeyondCorp Enterprise?

Resources:

Read More
#87
October 10, 2022

Next Special - Log4j Reflections, Software Dependencies and Open Source Security

Guest:

23:23

Topics covered:

  • Let's talk Open Source Software - are all these dependencies dependable?
  • Why was log4j such a big thing - at a whole ecosystem level?
  • Was it actually a Java / Maven problem? Are other languages “better” or more secure?
  • Is another log4j inevitable? What can organizations to minimize their own risks?

Resources:

Read More
#86
October 3, 2022

EP86 How to Apply Lessons from Virtualization Transition to Make Cloud Transformation Better

Guest:

27:27

Topics covered:

  • Virtualization's arrival caused a major IT upheaval 20 years ago. What can we learn from that revolution for our current cloud transformation?
  • We talk about our three legged security stool of people/process/technology. How do we balance the technical issues (new technology stack, etc) with the new processes (agile, etc) and the skills?
  • What are the cultural and people transformation differences between the virtualization and cloud revolutions?
  • We do recall how PCI DSS was disrupted by virtualization.  So, how does regulation play into this change - back then and now with the cloud?
  • How do we change the minds of regulators who still think that cloud is a risk to mitigate, rather than a way to mitigate others risks better?

Resources:

Read More
#85
September 26, 2022

EP85 Deploy Security Capabilities at Scale: SRE Explains How

Guest:

Steve McGhee, Reliability Advocate, Google Cloud

25:23

Topics covered:

  • What can security teams  learn from the Site Reliability Engineering (SRE) art of rapid and safe deployment?
  • Is this all about the process or do SREs possess some magical technology to do this?
  • What is SRE approach to automation?
  • What are the pillars / components of SRE approach to deployment?
  • SRE is also about scaling. Some security teams have to manage 1000s of detection rules, how can this be done in a manner that does not conflict or cause other problems?

Resources:

Read More
#84
September 19, 2022

EP84 How to Secure Artificial Intelligence (AI): Threats, Approaches, Lessons So Far

Guest:

27:29

Topics covered:

  • You did research by analyzing 2000 papers on AI attacks released in the previous decade. What are the main insights?
  • How do you approach discovering the relevant threat models for various AI systems and scenarios? 
  • Which threats are real today vs in a few years?
  • What are the common attack vectors? What do you see in the field of supply chain attacks on AI, software supply, data?
  • All these reported cyberphysical attacks on computer vision, how real are they, and what are the possible examples of exploitation? Are they a real danger to people?
  • What are the main differences between protecting AI vs protecting traditional enterprise applications?
  • Who should be responsible for Securing AI? What about for building trustworthy AI?
  • Given that the machinery of AI is often opaque, how to go about discovering vulnerabilities? Is there responsible disclosure for AI vulnerabilities, such as in open-source models and in public APIs? 
  • What should companies do first, when embarking on an AI security program? Who should have such a program?

Resources:

Read More
#83
September 12, 2022

EP83 What Does reCAPTCHA Actually Do and How Does It Do it? Product Manager Explains

Guest:

25:27

Topics covered:

  • What is reCAPTCHA? Aren’t you guys the super annoying 'click on the busses' thing?
  • What is account defender? Why was this a natural next step for you?
  • What are the actual threats that this handles - and handles well? Specific web attacks? Web fraud?
  • Let’s talk about account fraud, what do these attacks look like and how do bad guys monetize today?
  • What about payment fraud? Could you score a payment session as well as a login session risk, or is that different? 
  • How does this work with multi factor authentication?

Resources:

Read More
#82
September 5, 2022

EP82 Mega-confused by XDR? You Are Not Alone! This XDR Skeptic Clarifies!

Guest:

23:23

Topics covered:

  • How do you define that "XDR thing" that you are so skeptical about?
  • So within that definition of XDR, you think it’s not so great, why?
  • If you have to argue pro-XDR, what would you say?
  • Two main XDR camps are “XDR as EDR+” and “XDR as SIEM-”, which camp do you think is more right? Are both wrong?
  • What approach do you think is more useful as a lens to understand the potential upsides/downsides of XDR?
  • What about the cloud? "Cloud XDR" seems a bit illogical, but what do you think is the future of D&R in the cloud?

Resources:

Read More
#81
August 29, 2022

EP81 Demystify Data Sovereignty and Sovereign Cloud Secrets at Google Cloud

Guest:

25:25

Topics covered:

  • In political science, they define sovereignty as a local monopoly on the legitimate use of force. Why are we talking about “sovereignty” in IT?
  • What is a sovereign cloud?  How much of the term is marketing vs engineering?
  • Who cares or should care about sovereign cloud?
  • Is this about technical controls or paper/policy controls? Or both?
  • What is the role for encryption and key management and key access justifications (like say Google Cloud EKM with KAJ) for sovereign cloud?
  • Is sovereign cloud automatically more secure or at least has better data security?
  • What threat models are considered for sovereign cloud technologies?

Resources:

Read More
#80
August 22, 2022

EP80 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?

Guest:

  • David Stone,  Staff Consultant at Office of the CISO, Google Cloud
27:27

Topics covered:

  • Speaking as a former CISO, what triggered your organization migration to the cloud?
  • When did you and the security team get brought in?
  • How did you plan your security team journey to the cloud?
  • Did you take going to cloud as an opportunity to change things beyond the tools you were using? 
  • As you got going into the cloud, what was the hardest part for your organization ?
  • What was most surprising? Good surprise and bad surprise?
  • How did you design security controls for the cloud?
  • How do you validate and verify security controls in the cloud? 
  • How did you incorporate your cloud environment into your SOC’s responsibility?
  • One final strategic question: is moving to Cloud a net risk reduction? Can it be?

Resources:

Read More