Cloud Security Podcast by Google

Anton Chuvakin
  • 4.8 (40)
  • Technology
  • Updated Weekly

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We're going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject's benefit or just for organizational benefit. We hope you'll join us if you're interested in where technology overlaps with process and bumps up against organizational design. We're hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can't keep as the world moves from on-premises computing to cloud computing.

  1. 43m ago

    EP289 Software Engineering vs. Software Craft: How Google Scalably Eliminates Classes of Vulnerabilities

    How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? In this episode, hosts Timothy Peacock and Anton Chuvakin sit down with Christoph Kern, Principal Security Engineer at Google, to look under the hood of "secure-by-design." They trace Google's 15-year engineering journey to fundamentally eliminate entire classes of vulnerabilities rather than just playing whack-a-mole with bugs after they are written. 🛠️ Software Engineering vs. Software Craft: Why Google ditched "be careful" programming checklists in favor of hard compiler and framework-level invariants that make security defects physically impossible to build. 📦 Hiding the Risky Abstractions: How replacing high-risk programming constructs (like raw pointers in C++ or raw injection sinks in browser code) with safe, compiler-enforced abstractions secures codebases at a scale humans can no longer manually audit. 📢 "Marketing Didn't Write It": Christoph and the hosts unpack why the concept of "eliminating a class of vulnerabilities" is a rigorous, mathematical reality at Google rather than just public relations hype. 🤝 Empathy vs. Opinionated Platforms: The secret feedback loop Google uses to build highly opinionated developer platforms (like Boq or browser-native safe types) that protect systems without turning developers into frustrated "software artists" fighting the compiler. 📈 The Android Productivity Proof: The real-world metrics from Google's Android team proving that shifting to memory-safe languages (like Rust) dramatically drops vulnerabilities while actually boosting developer velocity and lowering rollback rates

  2. Jul 27

    EP288 CISO Tested, Board Approved: Cloud Resilience with General Mills CISO Noah Korba

    How do you make sure your favorite cereal is always on the shelves when a cyber disaster strikes? In this episode, hosts Tim Peacock and Alicja Cade sit down with Noah Korba, VP of Digital Core, Cybersecurity, and Enterprise Architecture at General Mills, to look under the hood of "Mills Collaborative Recovery"—their intensive, annual two-week drill that actually recovers 90% of their Google Cloud estate to test real-world cyber resilience. ⌨️ "Clicking and Clacking" vs. Talking: Why General Mills ditched traditional tabletop discussions to actually run hands-on, keyboard-driven recoveries of their entire cloud infrastructure. 🥣 Protecting the Cinnamon Toast Crunch: How the team mapped out their "Minimum Viable Business" to keep critical supply chain and manufacturing operations moving. 🔑 The IT vs. OT Reality: The unique challenge of recovering factory equipment, where software updates won't work without a physical key turned on the warehouse floor. 💼 To Board or Not to Board: Noah's take on whether involving the board of directors in active cyber exercises is a valuable use of their time.

  3. Jul 20

    EP287: Creating Trust at Global Scale with Local AI: Reken-ing with Shuman Ghosemajumder

    Cloud Security Podcast Episode 285: Defending Against the AI DDoS Is internet trust fundamentally broken? On this episode, former Google "Click Fraud Czar" and Reken CEO Shuman Ghosemajumder joins hosts Tim Peacock and Nolan Karpinski to trace the evolution of automated fraud—from Gmail's early invite days to the origin of "credential stuffing." Discover why today's threat landscape feels like an AI DDoS, how cybercriminals exploit the "Smart Cow" resource model, and why running security models on-device is our best shot at defending against scaled AI slop without sacrificing data privacy. What you'll learn: 🧠 The "Smart Cow" Problem: How advanced exploit tools are built by the few and commoditized for the masses. 💻 On-Device Defense: Why local, lightweight AI models are the future of communications security. 🛡️ The Paranoia Protocol: Tim and Shuman's practical advice on validating identities in the age of deepfakes. 👉 Subscribe for your weekly dose of cloud security insights, piping hot every Monday! Watch the full episode on YouTube at youtube.com/@CloudSecPodcast.

  4. Jul 13

    EP286 Building an AI-pilled, solo vibe-coded, Clickhouse-based SIEM with Dan Lussier

    Can you build a fully functional, high-scale SIEM in just two weeks for under $7,000? In this episode of the Cloud Security Podcast, hosts Tim Peacock and Kyle Champlin sit down with long-time collaborator Dan Lucier, Founder of Nano, to unpack how he "vibe-coded" an entire SIEM from scratch during his end-of-year holiday break. Dan shares his journey of leveraging bleeding-edge AI code assistants to go from a Postgres prototype to a blazing-fast, production-ready SIEM built on Rust and ClickHouse. In this episode, we cover: 🛠️ The $7,000 Stack: How Dan utilized Claude Code and Kubernetes to build a lean platform running on 2 vCPUs and 4GB RAM while ingesting 10–20 GB of data daily. ⚡ Why ClickHouse? The database architectural decisions behind maintaining sub-second search speeds at massive scale. 🤖 AI-Pilled but Cautious: Why Dan takes a surprisingly conservative approach to AI case closure and triage (and how it compares to Google's Triage and Investigation Agent). 💻 Detection as Code: How MCP (Model Context Protocol) servers and AI are leveling the playing field for smaller security teams. Whether you're an AI enthusiast, a data nerd, or a security leader looking at the "fourth wave" of SIEM, this episode is a masterclass in modern, rapid-fire software engineering. 👉 Subscribe, leave a review, and join the debate on our LinkedIn page!

  5. Jul 6

    EP285 Scaling Lessons from Leading the NSA to Defending the World with Morgan Adamski

    Cloud Security Podcast by Google

  6. Jun 29

    EP284 Closest Alligator to the Canoe: How Transforming SOC Became P0 for Lloyds Bank

    https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-how-cisos-can-pursue-technical-and-cultural-resilience-q-a?e=48754805

  7. Jun 22

    EP283: How Google Cloud CISO Chris Betz Uses LLMs to Defend Billions of Users from Vulnerablities

    Cloud Security Podcast by Google

  8. Jun 15

    EP282: Debating Coupled or Decoupled SIEM with Alex Hurtado and Christopher Witter

    Cloud Security Podcast by Google

See All (290)

Trailer

Ratings & Reviews

4.8
out of 5
40 Ratings

About

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We're going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject's benefit or just for organizational benefit. We hope you'll join us if you're interested in where technology overlaps with process and bumps up against organizational design. We're hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can't keep as the world moves from on-premises computing to cloud computing.

Information

You Might Also Like