Episodes
-
Guest:
Michael Czapinski, Security & Reliability Enthusiast, Google
Topics:
“How Google protects its production services” paper covers how Google's infrastructure balances several crucial aspects, including security, reliability, development speed, and maintainability. How do you prioritize these competing demands in a real-world setting? What attack vectors do you consider most critical in the production environment, and how has Google’s defenses against these vectors improved over time? Can you elaborate on the concept of Foundational services and their significance in Google's security posture? How does your security approach adapt to this vast spectrum of sensitivity and purpose of our servers and services, actually? How do you implement this principle of zero touch prod for both human and service accounts within our complex infrastructure? Can you talk us through the broader approach you take through Workload Security Rings and how this helps?Resources:
“How Google protects its production services” paper (deep!) SLSA framework EP189 How Google Does Security Programs at Scale: CISO Insights EP109 How Google Does Vulnerability Management: The Not So Secret Secrets! EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil SREcon presentation on zero touch prod. The SRS book (free access) -
Guests:
Michele Chubirka, Staff Cloud Security Advocate, Google Cloud Sita Lakshmi Sangameswaran, Senior Developer Relations Engineer, Google CloudTopics:
What is your reaction to “in the cloud you are one IAM mistake away from a breach”? Do you like it or do you hate it? Or do you "it depends" it? :-) Everyone's talking about how "identity is the new perimeter" in the cloud. Can you break that down in simple terms? A lot of people say “in the cloud, you must do IAM ‘right’”. What do you think that means? What is the first or the main idea that comes to your mind when you hear it? What’s this stuff about least-privilege and separation-of-duties being less relevant? Why do they matter in the cloud that changes rapidly? What are your IAM Top Pet Peeves?Resources:
Video (LinkedIn, YouTube) EP127 Is IAM Really Fun and How to Stay Ahead of the Curve in Cloud IAM? EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler IAM: There and back again using resource hierarchies IAM so lost: A guide to identity in Google Cloud I Hate IAM: but I need it desperately EP33 Cloud Migrations: Security Perspectives from The Field EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use EP177 Cloud Incident Confessions: Top 5 Mistakes Leading to Breaches from Mandiant EP188 Beyond the Buzzwords: Identity's True Role in Cloud and SaaS Security “Identity Crisis: The Biggest Prize in Security” paper “Learn to love IAM: The most important step in securing your cloud infrastructure“ Next presentation -
Episodes manquant?
-
Guests:
Ante Gojsalic, Co-Founder & CTO at SplxAITopics:
What are some of the unique challenges in securing GenAI applications compared to traditional apps? What current attack surfaces are most concerning for GenAI apps, and how do you see these evolving in the future? Do you have your very own list of top 5 GenAI threats? Everybody seem to! What are the most common security mistakes you see clients make with GenAI? Can you explain the main goals when trying to add automation to pentesting for next-gen GenAI apps? What are your AI testing lessons from clients so far?Resources:
EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side EP135 AI and Security: The Good, the Bad, and the Magical EP185 SAIF-powered Collaboration to Secure AI: CoSAI and Why It Matters to You SAIF.google Next SAIF presentation with top 5 AI security issues Our Security of AI Papers and Blogs Explained -
Guest:
Travis Lanham, Uber Tech Lead (UTL) for Security Operations Engineering, Google Cloud
Topics:
There’s been a ton of discussion in the wake of the three SIEM week about the future of SIEM-like products. We saw a lot of takes on how this augurs the future of disassembled or decoupled SIEMs. Can you explain what these disassembled SIEMs are all about? What are the expected upsides of detaching your SIEM interface and security capabilities from your data backend? Tell us about the early days of SecOps (nee Chronicle) and why we didn’t go with this approach? What are the upsides of a tightly coupled datastore + security experience for a SIEM? Are there more risks or negatives of the decoupled/decentralized approach? Complexity and the need to assemble “at home” are on the list, right? One of the 50 things Google knew to be true back in the day was that product innovation comes from technical innovation, what’s the technical innovation driving decoupled SIEMs? So what about those security data lakes? Any insights?Resources:
EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations EP190 Unraveling the Security Data Fabric: Need, Benefits, and Futures EP184 One Week SIEM Migration: Fact or Fiction? Hacking Google video series Decoupled SIEM: Brilliant or …. Not :-) UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion So, Why Did I Join Chronicle Security? (2019) -
Guest:
Vijay Ganti, Director of Product Management, Google Cloud SecurityTopics:
What have been the biggest pain points for organizations trying to use threat intelligence (TI)? Why has it been so difficult to convert threat knowledge into effective security measures in the past? In the realm of AI, there's often hype (and people who assume “it’s all hype”). What's genuinely different about AI now, particularly in the context of threat intelligence? Can you explain the concept of "AI-driven operationalization" in Google TI? How does it work in practice? What's the balance between human expertise and AI in the TI process? Are there specific areas where you see the balance between human and AI involvement shifting in a few years? Google Threat Intelligence aims to be different. Why are we better from client PoV?Resources:
Google Threat Intel website “Future of Brain” book by Gary Marcus et al Detection engineering blog (Part 9) and the series Detect engineering blogs by David French The pyramid of pain blog, the classic “Scaling Up Malware Analysis with Gemini 1.5 Flash” and “From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis” blogs on Gemini for security -
Cross-over hosts:
Kaslin Fields, co-host at Kubernetes Podcast
Abdel Sghiouar, co-host at Kubernetes Podcast
Guest:
Michele Chubirka, Cloud Security Advocate, Google Cloud
Topics:
How would you approach answering the question ”what is more secure, container or a virtual machine (VM)?” Could you elaborate on the real-world implications of this for security, and perhaps provide some examples of when one might be a more suitable choice than the other? While containers boast a smaller attack surface (what about the orchestrator though?), VMs present a full operating system. How should organizations weigh these factors against each other? The speed of patching and updates is a clear advantage of containers. How significant is this in the context of today's rapidly evolving threat landscape? Are there any strategies organizations can employ to mitigate the slower update cycles associated with VMs? Both containers and VMs can be susceptible to misconfigurations, but container orchestration systems introduce another layer of complexity. How can organizations address this complexity and minimize the risk of misconfigurations leading to security vulnerabilities? What about combining containers and VMs. Can you provide some concrete examples of how this might be implemented? What benefits can organizations expect from such an approach, and what challenges might they face? How do you envision the security landscape for containers and VMs evolving in the coming years? Are there any emerging trends or technologies that could significantly impact the way we approach security for these two technologies?Resources:
Container Security, with Michele Chubrika (the same episode - with extras! - at our peer podcast, “Kubernetes Podcast from Google”) EP105 Security Architect View: Cloud Migration Successes, Failures and Lessons EP54 Container Security: The Past or The Future? DORA 2024 report Container Security: It’s All About the Supply Chain - Michele Chubirka Software composition analysis (SCA) DevSecOps Decisioning Principles Kubernetes CIS Benchmark Cloud-Native Consumption Principles State of WebAssembly outside the Browser - Abdel Sghiouar Why Perfect Compliance Is the Enemy of Good Kubernetes Security - Michele Chubirka - KubeCon NA 2024 -
Guest:
Daniel Shechter, Co-Founder and CEO at Miggo Security
Topics:
Why do we need Application Detection and Response (ADR)? BTW, how do you define it? Isn’t ADR a subset of CDR (for cloud)? What is the key difference that sets ADR apart from traditional EDR and CDR tools? Why can’t I just send my application data - or eBPF traces - to my SIEM and achieve the goals of ADR that way? We had RASP and it failed due to instrumentation complexities. How does an ADR solution address these challenges and make it easier for security teams to adopt and implement? What are the key inputs into an ADR tool? Can you explain how your ADR correlates cloud, container, and application contexts to provide a better view of threats? Could you share real-world examples of types of badness solved for users? How would ADR work with other application security technologies like DAST/SAST, WAF and ASPM? What are your thoughts on the evolution of ADR?Resources:
EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud EP143 Cloud Security Remediation: The Biggest Headache? Miggo research re: vulnerability ALBeast “WhatDR or What Detection Domain Needs Its Own Tools?” blog “Making Sense of the Application Security Product Market” blog “Effective Vulnerability Management: Managing Risk in the Vulnerable Digital Ecosystem“ book -
Guests:
Taylor Lehmann, Director at Office of the CISO, Google Cloud Luis Urena, Cloud Security Architect, Google CloudTopics
There is a common scenario where security teams are brought in after a cloud environment is already established. From your experience, how does this late involvement typically impact the organization's security posture and what are the immediate risks they face? Upon hearing this, many experts suggest that “burn the environment with fire” or “nuke it from orbit” are the only feasible approaches? What is your take on that suggestion? On the opposite side, what if business demands you don't touch anything but “make it secure” regardless? Could you walk us through some of the first critical steps you do after “inheriting a cloud” and why they are prioritized in this way? Why not just say “add MFA everywhere”? What may or will blow up? We also say “address overly permissive users and roles” and this sounds valuable, but also tricky. How do we go about it? What are the chances that the environment is in fact compromised already? When is Compromise Assessment the right call, it does cost money, right? How do you balance your team’s current priorities when you’ve just adopted an insecure cloud environment. How do you make tradeoffs among your existing stack and this new one?Resources:
“Confetti cannons or fire extinguishers? Here’s how to secure cloud surprises” EP179 Teamwork Under Stress: Expedition Behavior in Cybersecurity Incident Response IAM Recommender “TM" book by Adam Shostack “Checklist Manifesto” book “Moving shields into position: How you can organize security to boost digital transformation” (with a new paper!) -
Guest:
Nelly Porter, Director of PM, Cloud Security at Google CloudTopics:
Share your story and how you ended here doing confidential AI at Google? What problem does confidential compute + AI solve and for what clients? What are some specific real-world applications or use cases where you see the combination of AI and confidential computing making the most significant impact? What about AI in confidential vs AI on prem? Should those people just do on-prem AI instead? Which parts of the AI lifecycle need to be run in Confidential AI: Training? Data curation? Operational workloads? What are the performance (and thus cost) implications of running AI workloads in a confidential computing environment? Are there new risks that arise out of confidential AI?Resources:
Video EP48 Confidentially Speaking 2: Cloudful of Secrets EP1 Confidentially Speaking “To securely build AI on Google Cloud, follow these best practices“ blog (paper) -
Guest:
Dan Nutting, Manager - Cyber Defense, Google Cloud
Topics:
What is the Defender’s Advantage and why did Mandiant decide to put this out there?
This is the second edition. What is different about DA-II?
Why do so few defenders actually realize their Defender’s Advantage?
The book talks about the importance of being "intelligence-led" in cyber defense. Can you elaborate on what this means and how organizations can practically implement this approach?
Detection engineering is presented as a continuous cycle of adaptation. How can organizations ensure their detection capabilities remain effective and avoid fatigue in their SOC?
Many organizations don’t seem to want to make detections at all, what do we tell them?
What is this thing called “Mission Control”- it sounds really cool, can you explain it?
Resources:
Defender’s Advantage book
The Defender's Advantage: Using Artificial Intelligence in Cyber Defense supplemental paper
“Threat-informed Defense Is Hard, So We Are Still Not Doing It!” blog
Mandiant blog
-
Guest:
Josh Liburdi, Staff Security Engineer, BrexTopics:
What is this “security data fabric”? Can you explain the technology? Is there a market for this? Is this same as security data pipelines? Why is this really needed? Won’t your SIEM vendor do it? Who should adopt it? Or, as Tim says, what gets better once you deploy it? Is reducing cost a big part of the security data fabric story? Does the data quality improve with the use of security data fabric tooling? For organizations considering a security data fabric solution, what key factors should they prioritize in their evaluation and selection process? What is the connection between this and federated security data search? What is the likely future for this technology?Resources:
BSidesSF 2024 - Reinventing ETL for Detection and Response Teams (Josh Liburdi) “How to Build Your Own Security Data Pipeline (and why you shouldn’t!)” blog “Decoupled SIEM: Brilliant or Stupid?” blog “Security Correlation Then and Now: A Sad Truth About SIEM” blog (my #1 popular post BTW) “Log Centralization: The End Is Nigh?” blog “20 Years of SIEM: Celebrating My Dubious Anniversary” blog “Navigating the data current: Exploring Cribl.Cloud analytics and customer insights” report OCSF -
Guest:
Royal Hansen, CISO, Alphabet
Topics:
What were you thinking before you took that “Google CISO” job?
Google's infrastructure is vast and complex, yet also modern. How does this influence the design and implementation of your security programs compared to other organizations?
Are there any specific challenges or advantages that arise from operating at such a massive scale?
What has been most surprising about Google’s internal security culture that you wish you could export to the world at large?
What have you learned about scaling teams in the Google context?
How do you design effective metrics for your teams and programs?
So, yes, AI. Every organization is trying to weigh the risks and benefits of generative AI–do you have advice for the world at large based on how we’ve done this here?
Resources:
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
CISA Secure by Design
EP20 Security Operations, Reliability, and Securing Google with Heather Adkins
EP91 “Hacking Google”, Op Aurora and Insider Threat at Google
“Delivering Security at Scale: From Artisanal to Industrial”
SRE book: CHapter 5: Toil Elimination
SRS book: Security as an Emergent Property
What are Security Invariants?
EP185 SAIF-powered Collaboration to Secure AI: CoSAI and Why It Matters to You
“Against the Gods - Remarkable Story of Risk” book
-
Guest:
Dor Fledel, Founder and CEO of Spera Security, now Sr Director of Product Management at Okta
Topics:
We say “identity is the new perimeter,” but I think there’s a lof of nuance to it. Why and how does it matter specifically in cloud and SaaS security?
How do you do IAM right in the cloud?
Help us with the acronym soup - ITDR, CIEM also ISPM (ITSPM?), why are new products needed?
What were the most important challenges you found users were struggling with when it comes to identity management?
What advice do you have for organizations with considerable identity management debt? How should they start paying that down and get to a better place? Also: what is “identity management debt”?
Can you answer this from both a technical and organizational change management perspective?
It’s one thing to monitor how User identities, Service accounts and API keys are used, it’s another to monitor how they’re set up. When you were designing your startup, how did you pick which side of that coin to focus on first?
What’s your advice for other founders thinking about the journey from zero to 1 and the journey from independent to acquisition?
Resources:
EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler
EP127 Is IAM Really Fun and How to Stay Ahead of the Curve in Cloud IAM?
EP166 Workload Identity, Zero Trust and SPIFFE (Also Turtles!)
EP182 ITDR: The Missing Piece in Your Security Puzzle or Yet Another Tool to Buy?
“Secrets of power negotiating“ book
-
Guest:
Nicole Beckwith, Sr. Security Engineering Manager, Threat Operations @ Kroger
Topics:
What are the most important qualities of a successful SOC leader today?
What is your approach to building and maintaining a high-functioning SOC team?
How do you approach burnout in a SOC team?
What are some of the biggest challenges facing SOC teams today?
Can you share some specific examples of how you have built and - probably more importantly! - maintained a high-functioning SOC team?
What are your thoughts on the current state of SIEM technology? Still a core of SOC or not?
What advice would you give to someone who inherited a SOC? What should his/her 7/30/90 day plan include?
Resources:
EP180 SOC Crossroads: Optimization vs Transformation - Two Paths for Security Operations Center
EP181 Detection Engineering Deep Dive: From Career Paths to Scaling SOC Teams
EP58 SOC is Not Dead: How to Grow and Develop Your SOC for Cloud and Beyond
EP64 Security Operations Center: The People Side and How to Do it Right
EP73 Your SOC Is Dead? Evolve to Output-driven Detect and Respond!
EP26 SOC in a Large, Complex and Evolving Organization
“The first 90 days” book -
Guests:
A debate between Tim and Anton, no guests
Debate positions:
You must buy the majority of cloud security tools from a cloud provider, here is why.
You must buy the majority of cloud security tools from a 3rd party security vendor, here is why.
Resources:
EP74 Who Will Solve Cloud Security: A View from Google Investment Side
EP22 Securing Multi-Cloud from a CISO Perspective, Part 3
EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use
“The cloud trust paradox: To trust cloud computing more, you need the ability to trust it less” blog
“Snowcrash” book
VMTD
-
Guest:
David LaBianca, Senior Engineering Director, Google
Topics:
The universe of AI risks is broad and deep. We’ve made a lot of headway with our SAIF framework: can you give us a) a 90 second tour of SAIF and b) share how it’s gotten so much traction and c) talk about where we go next with it?
The Coalition for Secure AI (CoSAI) is a collaborative effort to address AI security challenges. What are Google's specific goals and expectations for CoSAI, and how will its success be measured in the long term?
Something we love about CoSAI is that we involved some unexpected folks, notably Microsoft and OpenAI. How did that come about?
How do we plan to work with existing organizations, such as Frontier Model Forum (FMF) and Open Source Security Foundation (OpenSSF)? Does this also complement emerging AI security standards?
AI is moving quickly. How do we intend to keep up with the pace of change when it comes to emerging threat techniques and actors in the landscape?
What do we expect to see out of CoSAI work and when? What should people be looking forward to and what are you most looking forward to releasing from the group?
We have proposed projects for CoSAI, including developing a defender's framework and addressing software supply chain security for AI systems. How can others use them? In other words, if I am a mid-sized bank CISO, do I care? How do I benefit from it?
An off-the-cuff question, how to do AI governance well?
Resources:
CoSAI site, CoSAI 3 projects
SAIF main site
Gen AI governance: 10 tips to level up your AI program
“Securing AI: Similar or Different?” paper
Our Security of AI Papers and Blogs Explained
-
Guest:
Manan Doshi, Senior Security Engineer @ EtsyQuestions:
In your experience, what are the biggest challenges organizations face when migrating to a new SIEM platform? How did you solve them? Many SIEM projects have problems, but a decent chunk of these problems are not about the tool being broken. How did you decide to migrate? When is it time to go? Specifically, how to avoid constant change from product to product, each time blaming the tool for what are essentially process failures? How did you handle detection content during migration? Was AI involved? How did you test for this: “Which platform will best enable our engineering team to build what we need?” Tell us more about the Detection as Code pipeline you use? “Completed SIEM migration in a single week!” Is this for real?Resources:
Google Cloud Security Summit (August 20, 2024) and “Etsy and the art of SIEM Migration” presentation “Ancillary Justice” book StreamAlert SIEM migration blog (spicy version / vanilla version / long detailed version) Can We Have “Detection as Code”? Google SecOps EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity? -
Guests:
Jaffa Edwards, Senior Security Manager @ Google Cloud
Lyka Segura, Cloud Security Engineer @ Google Cloud
Topics:
Security transformation is hard, do you have any secret tricks or methods that actually make it happen?
Can you share a story about a time when you helped a customer transform their cloud security posture? Not just improve, but actually transform!
What is your process for understanding their needs and developing a security solution that is tailored to them? What to do if a customer does not want to share what is necessary or does not know themselves?
What are some of the most common security mistakes that you see organizations make when they move to the cloud?
What about the customers who insist on practicing in the cloud the same way they did on-premise? What do you tell the organizations that insist that “cloud is just somebody else’s computer” and they insist on doing security the old-fashioned way?
What advice would you give to organizations that are just starting out on their cloud security journey?
What are the first three cloud security steps you recommend that work for a cloud environment they inherited?
References
EP86 How to Apply Lessons from Virtualization Transition to Make Cloud Transformation Better
For a successful cloud transformation, change your culture first
Building security guardrails for developers with Google Cloud
Google Cloud Consulting
-
Guest:
Adam Bateman, Co-founder and CEO, Push Security
Topics:
What is Identity Threat Detection and Response (ITDR)? How do you define it?
What gets better at a client organization once ITDR is deployed?
Do we also need “ISPM” (parallel to CDR/CSPM), and what about CIEM?
Workload identity ITDR vs human identity ITDR? Do we need both? Are these the same?
What are the alternatives to using ITDR? Can’t SIEM/UEBA help - perhaps with browser logs?
What are some of the common types of identity-based threats that ITDR can help detect?
What advice would you give to organizations that are considering implementing ITDR?
Resources:
ITDR Definition
ITDR blog by Push / solve problem
-
Guest:
Zack Allen, Senior Director of Detection & Research @ Datadog, creator of Detection Engineering Weekly
Topics:
What are the biggest challenges facing detection engineers today?
What do you tell people who want to consume detections and not engineer them?
What advice would you give to someone who is interested in becoming a detection engineer at her organization?
So, what IS a detection engineer? Do you need software skills to be one? How much breadth and depth do you need?
What should a SOC leader whose team totally lacks such skills do?
You created Detection Engineering Weekly. What motivated you to start this publication, and what are your goals for it? What are the learnings so far?
You work for a vendor, so how should customers think of vendor-made vs customer-made detections and their balance?
What goes into a backlog for detections and how do you inform it?
Resources:
Video (LinkedIn, YouTube)
Zacks’s newsletter: https://detectionengineering.net
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity?
The SRE book
“Detection Spectrum” blog
“Delivering Security at Scale: From Artisanal to Industrial” blog (and this too)
“Detection Engineering is Painful — and It Shouldn’t Be (Part 1)” blog series
“Detection as Code? No, Detection as COOKING!” blog
“Practical Threat Detection Engineering: A hands-on guide to planning, developing, and validating detection capabilities” book
SpecterOps blog
- Montre plus
