Cloud Security Podcast by Google-logo

Cloud Security Podcast by Google

Technology Podcasts

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit. We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit. We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Location:

United States

Description:

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit. We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Language:

English


Episodes

EP85 Deploy Security Capabilities at Scale: SRE Explains How

9/26/2022
Guest: Steve McGhee, Reliability Advocate, Google Cloud Topics: What can security teams learn from the Site Reliability Engineering (SRE) art of rapid and safe deployment?Is this all about the process or do SREs possess some magical technology to do this?What is SRE approach to automation?What are the pillars / components of SRE approach to deployment?SRE is also about scaling. Some security teams have to manage 1000s of detection rules, how can this be done in a manner that does not...

Duration:00:30:48

EP84 How to Secure Artificial Intelligence (AI): Threats, Approaches, Lessons So Far

9/19/2022
Guest: Alex Polyakov, CEO of Adversa.ai Topics: You did research by analyzing 2000 papers on AI attacks released in the previous decade. What are the main insights?How do you approach discovering the relevant threat models for various AI systems and scenarios? Which threats are real today vs in a few years?What are the common attack vectors?All these reported cyberphysical attacks on computer vision, how real are they, and what are the possible examples of exploitation? Are they a real...

Duration:00:26:28

EP83 What Does reCAPTCHA Actually Do and How Does It Do it? Product Manager Explains

9/12/2022
Guest: Badr Salmi, Product Manager for reCAPTCHA Topics: What is reCAPTCHA? Aren’t you guys the super annoying 'click on the busses' thing?What is account defender? Why was this a natural next step for you?What are the actual threats that this handles - and handles well? Specific web attacks? Web fraud?Let’s talk about account fraud, what do these attacks look like and how do bad guys monetize today?What about payment fraud? Could you score a payment session as well as a login session...

Duration:00:27:16

EP82 Mega-confused by XDR? You Are Not Alone! This XDR Skeptic Clarifies!

9/5/2022
Guest: Dimitri McKay, Principal Security Strategist @ Splunk Topics: How do you define that "XDR thing" that you are so skeptical about?So within that definition of XDR, you think it’s not so great, why?If you have to argue pro-XDR, what would you say?Two main XDR camps are “XDR as EDR+” and “XDR as SIEM-”, which camp do you think is more right? Are both wrong?What approach do you think is more useful as a lens to understand the potential upsides/downsides of XDR?What about the cloud?...

Duration:00:27:58

EP81 Demystify Data Sovereignty and Sovereign Cloud Secrets at Google Cloud

8/29/2022
Guest: Christopher “CJ” Johnson, retired Fire Chief, and Global Regulated Cloud Product Lead @ Google Cloud Topics: In political science, they define sovereignty as a local monopoly on the legitimate use of force. Why are we talking about “sovereignty” in IT?What is a sovereign cloud? How much of the term is marketing vs engineering?Who cares or should care about sovereign cloud?Is this about technical controls or paper/policy controls? Or both?What is the role for encryption and key...

Duration:00:26:03

EP80 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?

8/22/2022
Guest: David Stone Topics: Speaking as a former CISO, what triggered your organization migration to the cloud?When did you and the security organization get brought in?How did you plan your security organization journey to the cloud?Did you take going to Cloud as an opportunity to change thingsbeyondthe tools you were using? As you got going into the cloud, what was the hardest part for your organization ?What was most surprising? Good surprise and bad surprise?How did you design security...

Duration:00:29:18

EP79 Modernize Data Security with Autonomic Data Security Approach

8/15/2022
Guest: John Stone, Chaos Coordinator @ Office of the CISO, Google Cloud Topics: So what is Autonomic Data Security, described in our just released paper? What are some notorious data security issues today? Perhaps common data security mistakes security leaders commit?What never worked in data security, like say manual data classification?How should organizations think about securing the data they migrated and the data that was created in the cloud?Do you really believe the cloud can make...

Duration:00:27:35

EP78 Classic SOC Meets Cloud: What Changes? What Stays the Same?

8/8/2022
Guest: Gorka Sadowski, Chief Strategy Officer @ Exabeam Topics: How do we get a legacy SOC team to think about the cloud?How to think about cloud threat detection, in general? What is different … threats, the environment, what else? What is the same? How do we know which TTPs are relevant for the new environments? What to bring with us to the cloud?Do content/rules and detection engines need to be different to cover the cloud detection use cases?What cases are appropriate for machine...

Duration:00:28:24

EP77 Operational Realities of SOAR: Automate and/or Enrich, Playbooks, Magic

8/1/2022
Guest: Cyrus Robinson, SOC Director and IR Team lead at Ingalls Information Security Topics: You’ve been using SOAR tools for years, so what do you think of the technology so far?What is driving SOAR adoption today? And what is inhibiting SOAR adoption?Realistically, how hard is SOAR to operationalize for a typical company?What are your favorite SOAR playbooks to start with?How to build, train and keep the SOAR team? Do they need to code to succeed?We like the SOAR maturity model...

Duration:00:25:05

EP76 Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?

7/25/2022
Guest: Ben Johnson, CTO/co-founder @ Obsidian Security Topics: Why is there so much attention lately on SaaS security? Doesn’t this area date back to2015 or so? What do you see as the primary challenges in securing SaaS? What does a SaaS threat model look like? What are the top threats you see? CASB has been the fastest growing security market and it has grown into a broad platform and many assume that “securing SaaS = using CASB”, what are they missing? Where would another technology...

Duration:00:30:14

EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil

7/18/2022
Guest: Tim Nguyen, Director of Detection and Response @ Google Topics: I know we don’t like to say “SOC” here, so why don’t we talk about the role of automation in detection and response (D&R) at Google?One SRE concept we found useful in security operations is “toil” - How do we squeeze toil out of D&R practice at Google?A combined analyst and engineer role (just like an SRE) was critical for both increasing automation and reducing toil, how hard was it to put this into practice? Tell us...

Duration:00:26:49

EP74 Who Will Solve Cloud Security: A View from Google Investment Side

7/11/2022
Guest: James Luo, Partner @ CapitalG Topics: You've looked at hundreds of security startups at the growth stage - what is getting funded? What is not getting funded? What is the difference?What's your view on the current market environment for security companies? Is security "recession-proof", whatever that means?How do you think about what problems are worth solving with a new venture vs existing vendors (and/or CSPs) expanding to cover the new area?Why do many cloud security vendors get...

Duration:00:26:29

EP73 Your SOC Is Dead? Evolve to Output-driven Detect and Respond!

7/5/2022
Guest: Erik Bloch, Senior Director of Detection and Response at Sprinklr Topics: You recently coined a concept of “output-driven Detection and Response” and even perhaps broader “output-driven security.” What is it and how does it work?Detection and response is alive (obviously), but sometimes you say SOC is dead, what do you mean by that?You refer to a federated approach for Detection and Response” (“route the outcomes to the teams that need them or can address them”), but is it workable...

Duration:00:27:55

EP72 What Does Good Detection and Response Look Like in the Cloud? Insights from Expel MDR

6/27/2022
Guests: Dave “Merk” Merkel, CEO @ Expel Peter Silberman, CTO @ Expel Topics: Many MDRs claim to be “security from the cloud”, but they actually don’t know much about cloud security. What does good looks like for MDR in the cloud (cloud being a full range from IaaS to SaaS)?What are the key challenges for clients picking an MDR for their cloud environments? What are the questions to ask your potential MDR?Do clients want the same security outcomes done in the cloud vs on-premise? Does it...

Duration:00:32:01

EP71 Attacking Google to Defend Google: How Google Does Red Team

6/21/2022
Guest: Stefan Friedli, Senior Security Engineer @ Google Topics: What is our “red team” testing philosophy and approach at Google? How did we evolve to this approach? What is the path from testing to making Google and our users more secure?What is unique about red teaming at Google?Care to share some fun testing stories or examples from your experience? Resources: “Building Secure & Reliable Systems” book(free)Threat Analysis Group (TAG) blog

Duration:00:22:45

EP70 Special - RSA 2022 Reflections - Securing the Past vs Securing the Future

6/16/2022
Guests: none Topics: What have we seen at the RSA 2022 Conference?What was the most interesting and unexpected?What was missing? Resources: “RSA 2022 Musings: The Past and The Future of Security” Google Cloud Security at RSA 2022

Duration:00:22:48

EP69 Cloud Threats and How to Observe Them

6/13/2022
Guest: James Condon, Director of Security Research @ Lacework Topics: What are realistic and actually observed cloud threats today? How did you observe them at Lacework?Cloud threats: are they on-premise style threats to cloud assets? We hate the line “cloud is just somebody else’s computer” but apparently threats actors seem to think so?What is the 2nd most dangerous cloud issue after configuration mistakes?Why is it so common for organizations to have insecure configurations in their...

Duration:00:29:39

EP68 How We Attack AI? Learn More at Our RSA Panel!

6/6/2022
Guest: Nicholas Carlini, Research Scientist @ Google Topics: What is your threat model for a large-scale AI system? How do you approach this problem? How do you rank the attacks?How do you judge if an attack is something to mitigate? How do you separate realistic from theoretical?Are there AI threats that were theoretical in 2020, but may become a daily occurrence in 2025?What are the threat-derived lessons for securing AI?Do we practice the same or different approaches for secure AI and...

Duration:00:28:10

EP67 Cyber Defense Matrix and Does Cloud Security Have to DIE to Win?

5/31/2022
Guest: Sounil Yu, CISO and Head of Research at JupiterOne Topics: How does your Cyber Defense Matrix apply to cloud security? Are things easier or harder?Cloud (at least the cloudy-cloud, also called cloud native) definitely supports “Distributed Immutable Ephemeral” (DIE) - your new creation, how does that change security and CDM?Cyber resilience generates a lot of confusion, how do you define and describe it? BTW, is the cloud more or less cyber resilient based on your definition?Is...

Duration:00:25:56

EP66 Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance

5/23/2022
Guest: Sandra Guo, Product Manager in Security, Google Cloud Topics: We have a really interesting problem here: if we make great investments in our use of trusted repositories, and great investments in doing code review on every change, and securing our build systems, and having reproducible builds, how do we know that all of what we did upstream is actually what gets deployed to production?What are the realistic threats thatBinary Authorizationhandles? Are there specific organizations...

Duration:00:24:54