Episoder
-
Guest:
Josh Liburdi, Staff Security Engineer, BrexTopics:
What is this “security data fabric”? Can you explain the technology? Is there a market for this? Is this same as security data pipelines? Why is this really needed? Won’t your SIEM vendor do it? Who should adopt it? Or, as Tim says, what gets better once you deploy it? Is reducing cost a big part of the security data fabric story? Does the data quality improve with the use of security data fabric tooling? For organizations considering a security data fabric solution, what key factors should they prioritize in their evaluation and selection process? What is the connection between this and federated security data search? What is the likely future for this technology?Resources:
BSidesSF 2024 - Reinventing ETL for Detection and Response Teams (Josh Liburdi) “How to Build Your Own Security Data Pipeline (and why you shouldn’t!)” blog “Decoupled SIEM: Brilliant or Stupid?” blog “Security Correlation Then and Now: A Sad Truth About SIEM” blog (my #1 popular post BTW) “Log Centralization: The End Is Nigh?” blog “20 Years of SIEM: Celebrating My Dubious Anniversary” blog “Navigating the data current: Exploring Cribl.Cloud analytics and customer insights” report OCSF -
Guest:
Royal Hansen, CISO, Alphabet
Topics:
What were you thinking before you took that “Google CISO” job?
Google's infrastructure is vast and complex, yet also modern. How does this influence the design and implementation of your security programs compared to other organizations?
Are there any specific challenges or advantages that arise from operating at such a massive scale?
What has been most surprising about Google’s internal security culture that you wish you could export to the world at large?
What have you learned about scaling teams in the Google context?
How do you design effective metrics for your teams and programs?
So, yes, AI. Every organization is trying to weigh the risks and benefits of generative AI–do you have advice for the world at large based on how we’ve done this here?
Resources:
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
CISA Secure by Design
EP20 Security Operations, Reliability, and Securing Google with Heather Adkins
EP91 “Hacking Google”, Op Aurora and Insider Threat at Google
“Delivering Security at Scale: From Artisanal to Industrial”
SRE book: CHapter 5: Toil Elimination
SRS book: Security as an Emergent Property
What are Security Invariants?
EP185 SAIF-powered Collaboration to Secure AI: CoSAI and Why It Matters to You
“Against the Gods - Remarkable Story of Risk” book
-
Mangler du episoder?
-
Guest:
Dor Fledel, Founder and CEO of Spera Security, now Sr Director of Product Management at Okta
Topics:
We say “identity is the new perimeter,” but I think there’s a lof of nuance to it. Why and how does it matter specifically in cloud and SaaS security?
How do you do IAM right in the cloud?
Help us with the acronym soup - ITDR, CIEM also ISPM (ITSPM?), why are new products needed?
What were the most important challenges you found users were struggling with when it comes to identity management?
What advice do you have for organizations with considerable identity management debt? How should they start paying that down and get to a better place? Also: what is “identity management debt”?
Can you answer this from both a technical and organizational change management perspective?
It’s one thing to monitor how User identities, Service accounts and API keys are used, it’s another to monitor how they’re set up. When you were designing your startup, how did you pick which side of that coin to focus on first?
What’s your advice for other founders thinking about the journey from zero to 1 and the journey from independent to acquisition?
Resources:
EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler
EP127 Is IAM Really Fun and How to Stay Ahead of the Curve in Cloud IAM?
EP166 Workload Identity, Zero Trust and SPIFFE (Also Turtles!)
EP182 ITDR: The Missing Piece in Your Security Puzzle or Yet Another Tool to Buy?
“Secrets of power negotiating“ book
-
Guest:
Nicole Beckwith, Sr. Security Engineering Manager, Threat Operations @ Kroger
Topics:
What are the most important qualities of a successful SOC leader today?
What is your approach to building and maintaining a high-functioning SOC team?
How do you approach burnout in a SOC team?
What are some of the biggest challenges facing SOC teams today?
Can you share some specific examples of how you have built and - probably more importantly! - maintained a high-functioning SOC team?
What are your thoughts on the current state of SIEM technology? Still a core of SOC or not?
What advice would you give to someone who inherited a SOC? What should his/her 7/30/90 day plan include?
Resources:
EP180 SOC Crossroads: Optimization vs Transformation - Two Paths for Security Operations Center
EP181 Detection Engineering Deep Dive: From Career Paths to Scaling SOC Teams
EP58 SOC is Not Dead: How to Grow and Develop Your SOC for Cloud and Beyond
EP64 Security Operations Center: The People Side and How to Do it Right
EP73 Your SOC Is Dead? Evolve to Output-driven Detect and Respond!
EP26 SOC in a Large, Complex and Evolving Organization
“The first 90 days” book -
Guests:
A debate between Tim and Anton, no guests
Debate positions:
You must buy the majority of cloud security tools from a cloud provider, here is why.
You must buy the majority of cloud security tools from a 3rd party security vendor, here is why.
Resources:
EP74 Who Will Solve Cloud Security: A View from Google Investment Side
EP22 Securing Multi-Cloud from a CISO Perspective, Part 3
EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use
“The cloud trust paradox: To trust cloud computing more, you need the ability to trust it less” blog
“Snowcrash” book
VMTD
-
Guest:
David LaBianca, Senior Engineering Director, Google
Topics:
The universe of AI risks is broad and deep. We’ve made a lot of headway with our SAIF framework: can you give us a) a 90 second tour of SAIF and b) share how it’s gotten so much traction and c) talk about where we go next with it?
The Coalition for Secure AI (CoSAI) is a collaborative effort to address AI security challenges. What are Google's specific goals and expectations for CoSAI, and how will its success be measured in the long term?
Something we love about CoSAI is that we involved some unexpected folks, notably Microsoft and OpenAI. How did that come about?
How do we plan to work with existing organizations, such as Frontier Model Forum (FMF) and Open Source Security Foundation (OpenSSF)? Does this also complement emerging AI security standards?
AI is moving quickly. How do we intend to keep up with the pace of change when it comes to emerging threat techniques and actors in the landscape?
What do we expect to see out of CoSAI work and when? What should people be looking forward to and what are you most looking forward to releasing from the group?
We have proposed projects for CoSAI, including developing a defender's framework and addressing software supply chain security for AI systems. How can others use them? In other words, if I am a mid-sized bank CISO, do I care? How do I benefit from it?
An off-the-cuff question, how to do AI governance well?
Resources:
CoSAI site, CoSAI 3 projects
SAIF main site
Gen AI governance: 10 tips to level up your AI program
“Securing AI: Similar or Different?” paper
Our Security of AI Papers and Blogs Explained
-
Guest:
Manan Doshi, Senior Security Engineer @ EtsyQuestions:
In your experience, what are the biggest challenges organizations face when migrating to a new SIEM platform? How did you solve them? Many SIEM projects have problems, but a decent chunk of these problems are not about the tool being broken. How did you decide to migrate? When is it time to go? Specifically, how to avoid constant change from product to product, each time blaming the tool for what are essentially process failures? How did you handle detection content during migration? Was AI involved? How did you test for this: “Which platform will best enable our engineering team to build what we need?” Tell us more about the Detection as Code pipeline you use? “Completed SIEM migration in a single week!” Is this for real?Resources:
Google Cloud Security Summit (August 20, 2024) and “Etsy and the art of SIEM Migration” presentation “Ancillary Justice” book StreamAlert SIEM migration blog (spicy version / vanilla version / long detailed version) Can We Have “Detection as Code”? Google SecOps EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity? -
Guests:
Jaffa Edwards, Senior Security Manager @ Google Cloud
Lyka Segura, Cloud Security Engineer @ Google Cloud
Topics:
Security transformation is hard, do you have any secret tricks or methods that actually make it happen?
Can you share a story about a time when you helped a customer transform their cloud security posture? Not just improve, but actually transform!
What is your process for understanding their needs and developing a security solution that is tailored to them? What to do if a customer does not want to share what is necessary or does not know themselves?
What are some of the most common security mistakes that you see organizations make when they move to the cloud?
What about the customers who insist on practicing in the cloud the same way they did on-premise? What do you tell the organizations that insist that “cloud is just somebody else’s computer” and they insist on doing security the old-fashioned way?
What advice would you give to organizations that are just starting out on their cloud security journey?
What are the first three cloud security steps you recommend that work for a cloud environment they inherited?
References
EP86 How to Apply Lessons from Virtualization Transition to Make Cloud Transformation Better
For a successful cloud transformation, change your culture first
Building security guardrails for developers with Google Cloud
Google Cloud Consulting
-
Guest:
Adam Bateman, Co-founder and CEO, Push Security
Topics:
What is Identity Threat Detection and Response (ITDR)? How do you define it?
What gets better at a client organization once ITDR is deployed?
Do we also need “ISPM” (parallel to CDR/CSPM), and what about CIEM?
Workload identity ITDR vs human identity ITDR? Do we need both? Are these the same?
What are the alternatives to using ITDR? Can’t SIEM/UEBA help - perhaps with browser logs?
What are some of the common types of identity-based threats that ITDR can help detect?
What advice would you give to organizations that are considering implementing ITDR?
Resources:
ITDR Definition
ITDR blog by Push / solve problem
-
Guest:
Zack Allen, Senior Director of Detection & Research @ Datadog, creator of Detection Engineering Weekly
Topics:
What are the biggest challenges facing detection engineers today?
What do you tell people who want to consume detections and not engineer them?
What advice would you give to someone who is interested in becoming a detection engineer at her organization?
So, what IS a detection engineer? Do you need software skills to be one? How much breadth and depth do you need?
What should a SOC leader whose team totally lacks such skills do?
You created Detection Engineering Weekly. What motivated you to start this publication, and what are your goals for it? What are the learnings so far?
You work for a vendor, so how should customers think of vendor-made vs customer-made detections and their balance?
What goes into a backlog for detections and how do you inform it?
Resources:
Video (LinkedIn, YouTube)
Zacks’s newsletter: https://detectionengineering.net
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity?
The SRE book
“Detection Spectrum” blog
“Delivering Security at Scale: From Artisanal to Industrial” blog (and this too)
“Detection Engineering is Painful — and It Shouldn’t Be (Part 1)” blog series
“Detection as Code? No, Detection as COOKING!” blog
“Practical Threat Detection Engineering: A hands-on guide to planning, developing, and validating detection capabilities” book
SpecterOps blog
-
Guests:
Mitchell Rudoll, Specialist Master, Deloitte
Alex Glowacki, Senior Consultant, Deloitte
Topics:
The paper outlines two paths for SOCs: optimization or transformation. Can you elaborate on the key differences between these two approaches and the factors that should influence an organization's decision on which path to pursue?
The paper also mentions that alert overload is still a major challenge for SOCs. What are some of the practices that work in 2024 for reducing alert fatigue and improving the signal-to-noise ratio in security signals?
You also discuss the importance of automation for SOCs. What are some of the key areas where automation can be most beneficial, and what are some of the challenges of implementing automation in SOCs? Automation is often easier said than done…
What specific skills and knowledge will be most important for SOC analysts in the future that people didn’t think of 5-10 years ago?
Looking ahead, what are your predictions for the future of SOCs? What emerging technologies do you see having the biggest impact on how SOCs operate?
Resources:
“Future of the SOC: Evolution or Optimization —Choose Your Path” paper and highlights blog
“Meet the Ghost of SecOps Future” video based on the paper
EP58 SOC is Not Dead: How to Grow and Develop Your SOC for Cloud and Beyond
The original Autonomic Security Operations (ASO) paper (2021)
“New Paper: “Future of the SOC: Forces shaping modern security operations” (Paper 1 of 4)”
“New Paper: “Future of the SOC: SOC People — Skills, Not Tiers” (Paper 2 of 4)”
“New Paper: “Future Of The SOC: Process Consistency and Creativity: a Delicate Balance” (Paper 3 of 4)”
-
Guests:
Robin Shostack, Security Program Manager, Google
Jibran Ilyas, Managing Director Incident Response, Mandiant, Google Cloud
Topics:
You talk about “teamwork under adverse conditions” to describe expedition behavior (EB). Could you tell us what it means?
You have been involved in response to many high profile incidents, one of the ones we can talk about publicly is one of the biggest healthcare breaches at this time. Could you share how Expedition Behavior played a role in our response?
Apart from during incident response which is almost definitionally an adverse condition, how else can security teams apply this knowledge?
If teams are going to embrace an expeditionary behavior mindset, how do they learn it? It’s probably not feasible to ship every SOC team member off to the Okavango Delta for a NOLS course. Short of that, how do we foster EB in a new team?
How do we create it in an existing team or an under-performing team?
Resources:
EP174 How to Measure and Improve Your Cloud Incident Response Readiness: A New Framework
EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?
“Take a few of these: Cybersecurity lessons for 21st century healthcare professionals” blog
Getting More by Stuart Diamond book
Who Moved My Cheese by Spencer Johnson book
-
Guest:
Brandon Wood, Product Manager for Google Threat Intelligence
Topics:
Threat intelligence is one of those terms that means different things to everyone–can you tell us what this term has meant in the different contexts of your career? What do you tell people who assume that “TI = lists of bad IPs”?
We heard while prepping for this show that you were involved in breaking up a human trafficking ring: tell us about that!
In Anton’s experience, a lot of cyber TI is stuck in “1. Get more TI 2. ??? 3. Profit!” How do you move past that?
One aspect of threat intelligence that’s always struck me as goofy is the idea that we can “monitor the dark web” and provide something useful. Can you change my mind on this one?
You told us your story of getting into sales, you recently did a successful rotation into the role of Product Manager,, can you tell us about what motivated you to do this and what the experience was like?
Are there other parts of your background that inform the work you’re doing and how you see yourself at Google?
How does that impact our go to market for threat intelligence, and what’re we up to when it comes to keeping the Internet and broader world safe?
Resources:
VideoEP175 Meet Crystal Lister: From Public Sector to Google Cloud Security and Threat Horizons
EP128 Building Enterprise Threat Intelligence: The Who, What, Where, and Why
EP112 Threat Horizons - How Google Does Threat Intelligence
Introducing Google Threat Intelligence: Actionable threat intelligence at Google scale
A Requirements-Driven Approach to Cyber Threat Intelligence
-
Guests:
Omar ElAhdan, Principal Consultant, Mandiant, Google Cloud
Will Silverstone, Senior Consultant, Mandiant, Google Cloud
Topics:
Most organizations you see use both cloud and on-premise environments. What are the most common challenges organizations face in securing their hybrid cloud environments?
You do IR so in your experience, what are top 5 mistakes organizations make that lead to cloud incidents?
How and why do organizations get the attack surface wrong? Are there pillars of attack surface?
We talk a lot about how IAM matters in the cloud. Is that true that AD is what gets you in many cases even for other clouds?
What is your best cloud incident preparedness advice for organizations that are new to cloud and still use on-prem as well?
Resources:
Next 2024 LIVE Video of this episode / LinkedIn version (sorry for the audio quality!)
“Lessons Learned from Cloud Compromise” podcast at The Defender’s Advantage
“Cloud compromises: Lessons learned from Mandiant investigations” in 2023 from Next 2024
EP174 How to Measure and Improve Your Cloud Incident Response Readiness: A New Framework
EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler
-
Guest:
Seth Vargo, Principal Software Engineer responsible for Google's use of the public cloud, Google
Topics:Google uses the public cloud, no way, right? Which one? Oh, yeah, I guess this is obvious: GCP, right?
Where are we like other clients of GCP? Where are we not like other cloud users?
Do we have any unique cloud security technology that we use that others may benefit from?
How does our cloud usage inform our cloud security products?
So is our cloud use profile similar to cloud natives or traditional companies?
What are some of the most interesting cloud security practices and controls that we use that are usable by others?
How do we make them work at scale?
Resources:
EP12 Threat Models and Cloud Security (previous episode with Seth)
EP66 Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics
IAM Deny
Seth Vargo blog
“Attention Is All You Need” paper (yes, that one)
-
Guest:
Crystal Lister, Technical Program Manager, Google Cloud Security
Topics:
Your background can be sheepishly called “public sector”, what’s your experience been transitioning from public to private? How did you end up here doing what you are doing?
We imagine you learned a lot from what you just described – how’s that impacted your work at Google?
How have you seen risk management practices and outcomes differ?
You now lead Google Threat Horizons reports, do you have a vision for this? How does your past work inform it?
Given the prevalence of ransomware attacks, many organizations are focused on external threats. In your experience, does the risk of insider threats still hold significant weight? What type of company needs a dedicated and separate insider threat program?
Resources:
Video on YouTube
Google Cybersecurity Action Team Threat Horizons Report #9 Is Out!
Google Cybersecurity Action Team site for previous Threat Horizons Reports
EP112 Threat Horizons - How Google Does Threat Intelligence
Psychology of Intelligence Analysis by Richards J. Heuer
The Coming Wave by Mustafa Suleyman
Visualizing Google Cloud: 101 Illustrated References for Cloud Engineers and Architects
-
Guest:
Angelika Rohrer, Sr. Technical Program Manager , Cyber Security Response at Alphabet
Topics:
Incident response (IR) is by definition “reactive”, but ultimately incident prep determines your IR success. What are the broad areas where one needs to prepare?
You have created a new framework for measuring how ready you are for an incident, what is the approach you took to create it?
Can you elaborate on the core principles behind the Continuous Improvement (CI) Framework for incident response?Why is continuous improvement crucial for effective incident response, especially in cloud environments? Can’t you just make a playbook and use it?
How to overcome the desire to focus on the easy metrics and go to more valuable ones?
What do you think Google does best in this area?
Can you share examples of how the CI Framework could have helped prevent or mitigate a real-world cloud security incident?
How can other organizations practically implement the CI Framework to enhance their incident response capabilities after they read the paper?
Resources:
“How do you know you are "Ready to Respond"? paper
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics
EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?
-
Guest:
Shan Rao, Group Product Manager, Google
Topics:
What are the unique challenges when securing AI for cloud environments, compared to traditional IT systems?
Your talk covers 5 risks, why did you pick these five? What are the five, and are these the worst?
Some of the mitigation seems the same for all risks. What are the popular SAIF mitigations that cover more of the risks?
Can we move quickly and securely with AI? How?
What future trends and developments do you foresee in the field of securing AI for cloud environments, and how can organizations prepare for them?
Do you think in 2-3 years AI security will be a separate domain or a part of … application security? Data security? Cloud security?
Resource:
Video (LinkedIn, YouTube) [live audio is not great in these]
“A cybersecurity expert's guide to securing AI products with Google SAIF“ presentation
SAIF Site
“To securely build AI on Google Cloud, follow these best practices” (paper)
“Secure AI Framework (SAIF): A Conceptual Framework for Secure AI Systems” resources
Corey Quinn on X (long story why this is here… listen to the episode)
-
Guests:
None
Topics:
What have we seen at RSA 2024?
Which buzzwords are rising (AI! AI! AI!) and which ones are falling (hi XDR)?
Is this really all about AI? Is this all marketing?
Security platforms or focused tools, who is winning at RSA?
Anything fun going on with SecOps?
Is cloud security still largely about CSPM?
Any interesting presentations spotted?
Resources:
EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side (RSA 2024 episode 1 of 2)
“From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis” blog
“Decoupled SIEM: Brilliant or Stupid?” blog
“Introducing Google Security Operations: Intel-driven, AI-powered SecOps” blog
“Advancing the art of AI-driven security with Google Cloud” blog
-
Guest:
Elie Bursztein, Google DeepMind Cybersecurity Research Lead, Google
Topics:
Given your experience, how afraid or nervous are you about the use of GenAI by the criminals (PoisonGPT, WormGPT and such)?
What can a top-tier state-sponsored threat actor do better with LLM? Are there “extra scary” examples, real or hypothetical?
Do we really have to care about this “dangerous capabilities” stuff (CBRN)? Really really?
Why do you think that AI favors the defenders? Is this a long term or a short term view?
What about vulnerability discovery? Some people are freaking out that LLM will discover new zero days, is this a real risk?
Resources:
“How Large Language Models Are Reshaping the Cybersecurity Landscape” RSA 2024 presentation by Elie (May 6 at 9:40AM)
“Lessons Learned from Developing Secure AI Workflows” RSA 2024 presentation by Elie (May 8, 2:25PM)
EP50 The Epic Battle: Machine Learning vs Millions of Malicious Documents
EP40 2021: Phishing is Solved?
EP135 AI and Security: The Good, the Bad, and the Magical
EP170 Redefining Security Operations: Practical Applications of GenAI in the SOC
EP168 Beyond Regular LLMs: How SecLM Enhances Security and What Teams Can Do With It
PyRIT LLM red-teaming tool
Accelerating incident response using generative AI
Threat Actors are Interested in Generative AI, but Use Remains Limited
OpenAI’s Approach to Frontier Risk
- Se mer
