Cloud Security Podcast by Google Anton Chuvakin

Guests:
Omar ElAhdan, Principal Consultant, Mandiant, Google Cloud
Will Silverstone, Senior Consultant, Mandiant, Google Cloud
Topics:
Most organizations you see use both cloud and on-premise environments. What are the most common challenges organizations face in securing their hybrid cloud environments?
You do IR so in your experience, what are top 5  mistakes organizations make that lead to cloud incidents?
How and why do organizations get the attack surface wrong? Are there pillars of attack surface?
We talk a lot about how IAM matters in the cloud.  Is that true that AD is what gets you in many cases even for other clouds?
What is your best cloud incident preparedness advice for organizations that are new to cloud and still use on-prem as well?
Resources:
Next 2024 LIVE Video of this episode / LinkedIn version (sorry for the audio quality!)
“Lessons Learned from Cloud Compromise” podcast at The Defender’s Advantage
“Cloud compromises: Lessons learned from Mandiant investigations” in 2023 from Next 2024
EP174 How to Measure and Improve Your Cloud Incident Response Readiness: A New Framework
EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler

Guest:
Seth Vargo, Principal Software Engineer responsible for Google's use of the public cloud, Google

Topics:
Google uses the public cloud, no way, right? Which one? Oh, yeah, I guess this is obvious: GCP, right?
Where are we like other clients of GCP?  Where are we not like other cloud users?
Do we have any unique cloud security technology that we use that others may benefit from?
How does our cloud usage inform our cloud security products?
So is our cloud use profile similar to cloud natives or traditional companies?
What are some of the most interesting cloud security practices and controls that we use that are usable by others?
How do we make them work at scale? 
Resources:
EP12 Threat Models and Cloud Security (previous episode with Seth)
EP66 Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics
IAM Deny
Seth Vargo blog
“Attention Is All You Need” paper (yes, that one)

Guest:
Crystal Lister, Technical Program Manager, Google Cloud Security
Topics:
Your background can be sheepishly called “public sector”, what’s your experience been transitioning from public to private? How did you end up here doing what you are doing?
We imagine you learned a lot from what you just described – how’s that impacted your work at Google?
How have you seen risk management practices and outcomes differ?
You now lead Google Threat Horizons reports, do you have a vision for this? How does your past work inform it?
Given the prevalence of ransomware attacks, many organizations are focused on external threats. In your experience, does the risk of insider threats still hold significant weight? What type of company needs a dedicated and separate insider threat program?
Resources:
Video on YouTube
Google Cybersecurity Action Team Threat Horizons Report #9 Is Out!
Google Cybersecurity Action Team site for previous Threat Horizons Reports
EP112 Threat Horizons - How Google Does Threat Intelligence
Psychology of Intelligence Analysis by Richards J. Heuer
The Coming Wave by Mustafa Suleyman 
Visualizing Google Cloud: 101 Illustrated References for Cloud Engineers and Architects
 

Guest:
Angelika Rohrer, Sr. Technical Program Manager , Cyber Security Response at Alphabet
Topics:
Incident response (IR) is by definition “reactive”, but ultimately incident prep determines your IR success. What are the broad areas where one needs to prepare?
You have created a new framework for measuring how ready you are for an incident, what is the approach you took to create it?
Can you elaborate on the core principles behind the Continuous Improvement (CI) Framework for incident response? Why is continuous improvement crucial for effective incident response, especially in cloud environments? Can’t you just make a playbook and use it?
How to overcome the desire to focus on the easy metrics and go to more valuable ones?
What do you think Google does best in this area?
Can you share examples of how the CI Framework could have helped prevent or mitigate a real-world cloud security incident?
How can other organizations practically implement the CI Framework to enhance their incident response capabilities after they read the paper?
Resources:
“How do you know you are "Ready  to Respond"? paper
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics
EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?
 

Guest:
Shan  Rao, Group Product Manager, Google 
Topics:
What are the unique challenges when securing AI for cloud environments, compared to traditional IT systems?
Your talk covers 5 risks, why did you pick these five? What are the five, and are these the worst?
Some of the mitigation seems the same for all risks. What are the popular SAIF mitigations that cover more of the risks?
Can we move quickly and securely with AI? How?
What future trends and developments do you foresee in the field of securing AI for cloud environments, and how can organizations prepare for them?
Do you think in 2-3 years AI security will be a separate domain or a part of … application security? Data security? Cloud security? 
Resource:
Video (LinkedIn, YouTube)  [live audio is not great in these]
“A cybersecurity expert's guide  to securing AI products with Google SAIF“ presentation
SAIF Site
“To securely build AI on Google Cloud, follow these best practices” (paper)
“Secure AI Framework (SAIF): A Conceptual Framework for Secure AI Systems” resources
Corey Quinn on X (long story why this is here… listen to the episode)

Guests:
None
Topics:
What have we seen at RSA 2024?
Which buzzwords are rising (AI! AI! AI!) and which ones are falling (hi XDR)?
Is this really all about AI? Is this all marketing?
Security platforms or focused tools, who is winning at RSA?
Anything fun going on with SecOps?
Is cloud security still largely about CSPM?
Any interesting presentations spotted?
Resources:
EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side (RSA 2024 episode 1 of 2)
“From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis” blog
“Decoupled SIEM: Brilliant or Stupid?” blog
“Introducing Google Security Operations: Intel-driven, AI-powered SecOps” blog
“Advancing the art of AI-driven security with Google Cloud” blog