Cloud Security Podcast
Episodes About Subscribe Voices Topics

Cloud Security Podcast

Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!

cloud-security-podcast_high_res.png

Episode list

#39
October 18, 2021

EP39 From False Positives to Karl Popper: Rationalizing Cloud Threat Detection

Guest:

27:23

Topics covered:

  • What are bad/good/great detections? Is this all about the Bianco's pyramid? Is high good and low bad?
  • How should we judge the quality of detections? Can there be a quality framework? Is that judgment going to be site specific?
  • What should we do to build more good directions? Is this all about reducing false positives?
  • Can we really measure false negatives? How can we approach this?
  • How can we test for detection goodness in the real world? What are the methods that work? It can’t be just about paper ATT&CK coverage, right?
  • What are your top 3 tips for improving the detection practice at an organization?

Resources:

Read More
#38
October 14, 2021

NEXT Special - 6 Cloud Security PMs (and a Developer Advocate!) Walk into a Studio

Guests:

  • Stephanie Wong,
  • Vicente Diaz, Jerome McFarland
  • Scott Ellis
  • Patrick Faucher
  • Il-Sung Lee, Anoosh Saboori
30:31

Topics covered:

  • What is your session about?
  • Why would audience care?
  • What is special about your security technology?

Resources:

Read More
#37
October 13, 2021

NEXT Special - Google Cybersecurity Action Team: What's the Story?

Guest:

  • Phil Venables (@philvenables), Vice President, Chief Information Security Officer (CISO) @ Google Cloud
23:23

Topics covered:

  • We are here to talk Google Cybersecurity Action Team, and this is your brainchild, so tell our audience the origin of this idea?
  • How is Cybersecurity Action Team going to help secure GCP enterprise clients?
  • Is there also a broader “improve the security of the internet” story?
  • Many organizations seem stuck in the pre-cloud thinking and mental models, can Cybersecurity Action Team help them transform their security? How?
  • When we sometimes present our security innovations to clients, they say “but we are not Google”, so how does Cybersecurity Action Team help us bring more of Google Cybersecurity to the world?
  • What else do we plan to do with Cybersecurity Action Team to help customers modernize their security?
  • How should customers engage with Cybersecurity Action Team?

Resources:

Read More
#36
October 12, 2021

NEXT Special - Cloud Security and DEI: Being an Ally!

Guest:

  • Aditi Joshi, Manager in Cloud Security Team @ Google Cloud
23:23

Topics covered:

  • What is Allyship? How is it defined? What is its main goal?
  • Why is allyship important in Cloud Security, specifically? Are there aspects of security that make allyship particularly important?
  • What specifically has Google Cloud Security deployed and operationalized around Allyship?
  • How does effective allyship look like? More personally, how can I be a better ally?
  • How does it fit into Google Cloud Security’s overarching DEI efforts?
Read More
#35
October 11, 2021

NEXT Special - Google Cloud NEXT Security: What to Watch?

Guest:

23:23

Topics covered:

  • What are the big security themes at NEXT? Is security still visible?
  • What about invisible security vs autonomic security? Is that just “invisible security” with a neat name?
  • This has got to be your fourth or fifth Next, right? What’s new this year compared to last years, aside from being virtual?
  • Anything particularly uniquely Google we’re talking about?
  • What to watch at NEXT, if you are a CISO?
  • We secure not just GCP with our tools and approaches, so what to watch if not yet a GCP client?
  • If you have only time for 3 security sessions, which 3 to watch?

Resources:

Read More
#34
October 4, 2021

EP34 Instrumenting Modern Application Stack for Detection and Response

Guest:

  • Matt Svensson, Senior Security Engineer @ BetterCloud
23:23

Topics covered:

  • What are the approaches for monitoring serverless and other modern application architectures?
  • What are the challenges with these new environments?
  • What approaches don’t work? What can go wrong with modern stack security monitoring?
  • What should we watch for in a modern application stack?
  • Most new architecture setups are predicated on identities so is identity the center of threat detection here or not?
Read More
#33
September 27, 2021

EP33 Cloud Migrations: Security Perspectives from The Field

Guest:

  • Elliott Abraham, Security and Compliance Specialist @ Google Cloud
23:23

Topics covered:

  • We talk about lift and shift vs cloud native, what are these and are they fair characterizations?
  • Is lift and shift always negative? Does it always harm security?
  • Are security planning needs different between them?
  • What are the fundamentals with security during cloud migration that you have to get right regardless?
  • What’s your advice to a security team to help make a migration work well?
  • How do you account for threat model differences in the cloud? Are cloud threats being more different or more the same to the classic ones?

Resources:

Read More
#32
September 20, 2021

EP32 Can You Ever Know Thyself: Cloud Attack Surface Management

Guest:

23:23

Topics covered:

  • Attack Surface Management (ASM). Why do we need a new toolset and  a new category? Isn’t this just 1980s asset management or CMDB?
  • How do we find those assets that may have been misplaced by the organizations? How can any technology do this reliably?
  • ASM seems to often rely on network layer 3 and 4. Can’t bad guys just hit the app endpoints and all your network is irrelevant then?
  • When you think about the threats organizations face due to unknown assets, is data theft at the top of the stack? What should organizations keep in mind as a priority here?
  • Who at an organization is best set up to receive, triage, investigate, and respond to the  alerts about the attack surface?
  • Are there proactive steps organizations can take to prevent shadow IT, or are we stuck responding to each new signal? Isn’t preventing new assets the same as preventing business?

Resources:

Read More
#31
September 13, 2021

EP31 Cloud Certifications, and Cloud Security with TheCertsGuy

Guest:

  • Iman Ghanizada,   Solutions Manager for Security Operations & Analytics @ Google Cloud
23:23

Topics covered:

  • What is your book “Google Cloud Certified Professional Cloud Architect All-in-One Exam Guide” about? 
  • What was your journey into writing this book, how long did it take?
  • The book seems to be targeted towards Cloud Architects, but you come from a predominantly security background, how has that influenced your writing of this book?
  • What does this have to do with The Certs Guy (14 certs!?)  and what's his mission?
  • What’s the intersectional thinking on certificates and making our industry more accessible and inclusive? Do certs help or hurt this?
  • So what’s your advice on certs for various career stages?
  • What are some of the biggest architectural challenges you’ve seen in the field of Cloud Security?

Resources:

Read More
#30
September 7, 2021

EP30 Malware Hunting with VirusTotal

Guest:

  • Vicente Diaz,  Threat Intelligence Strategist @ VirusTotal
25:25

Topics covered:

  • How would you describe modern threat hunting process?
  • Share some of the more interesting examples of attacker activities or artifacts you've seen?
  • Do we even hunt for malware? What gets you more concerned, malware or human attackers?
  • How do you handle the risk of attackers knowing how you perform hunting?
  • What is the role of threat research role for hunting? Do you need research to hunt well?
  • Does threat research power attribution?
  • How do you tell a good YARA rule from a bad one, and a great one?
  • What’s the evolutionary journey for a YARA rule?
  • What is your view on the future of hunting?

Resources:

Read More