Guest:

• Alicja Cade, Director for Financial Services, Office of the CISO, Google Cloud 

Topics:

• We are talking about your journey as a CISO migrating to the cloud. Could you give us the overview of …
• What triggered your organization's migration to the cloud? When did you and the security team get brought in?
• Did you take going to the cloud as an opportunity to change things beyond the tools you were using? 
• As you got going into the cloud, what was the hardest part for your organization?
• If that was hardest, what was most surprising? Good surprise and bad surprise?
• How did you design security controls for the cloud?
• How do you validate and verify security controls in the cloud?
• How did you keep both security practitioners and the rest of your IT teams from lift-and-shift thinking?
• Did your data security practice change?
• Having covered all that tactical terrain, one final strategic question: is moving to the cloud a net risk reduction? Can it be?

Resources:

• “CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?” (ep80)
• “Visualizing Google Cloud: 101 Illustrated References for Cloud Engineers and Architects” by Priyanka Vergadia
• “Cyberpolitics in International Relations” book
• CSA CCM v4
• Cyber Risk Institute
• “Modernize Data Security with Autonomic Data Security Approach” (ep79) and the paper on autonomic data security.
• "Preparing for Cloud Migrations from a CISO Perspective, Part 1" (ep5)
• "Preparing for Cloud Migrations from a CISO Perspective, Part 2" (ep11)
• “How CISOs need to adapt their mental models for cloud security” blog

Guests:

• Lauren Zabierek (@lzxdc), Acting Executive Director of the Belfer Center at the Harvard Kennedy School
• Christina Morillo (@divinetechygirl), Principal Security Consultant at Trimark Security

Topics:

• We are so excited to have you on the show today talking about your awesome effort, Share The Mic in Cyber. I love that we are Sharing our Mic with you today. Could you please introduce yourself to our listeners?
• Let's talk about representation and what that means, and why it's especially relevant in cyber security? 
• Psychological safety is super important for so many reasons, including  in cyber. Could you share a definition of what it is, and why it is important? 
• Can we talk about how psychological safety and representation intersect? 
• Let’s bring things back to talk about the #ShareTheMicInCyber / #STMIC project. Could you tell us about one of your favorite things that's come from the project?  Any surprises? Lessons? Plans? Futures?
• How can our listeners help with #ShareTheMicInCyber? Where to learn more?

Resources:

• #ShareTheMicInCyber site and @ShareInCyber on social
• Lauren Zabierek (@lzxdc), #ShareTheMic in Cyber co-founder
• Camille Stewart Gloster (@camilleesq), #ShareTheMic in Cyber co-founder
• “Missing Diversity Hurts Your Security” (ep42)
• NEXT Special - Cloud Security and DEI: Being an Ally! (ep36)

Guest:

• Mike Sinno, Security Engineering Director, Detection and Response  @ Google

Topics:

• You recently were featured in “Hacking Google” videos, can you share a bit about this effort and what role you played?
• How long have you been at Google? What were you doing before, if you can remember after all your time here? What brought you to Google?
• We hear you now focus on insider threats. Insider threat is back in the news, do you find this surprising?
• A classic insider question is about “malicious vs well-meaning insiders" and which type is a bigger risk. What is your take here?
• Trust is the most important thing when people think about Google, we protect their correspondence, their photos, their private thoughts they search for. What role does detection and response play in protecting user trust?
• One fun thing about working at Google is our tech stack. Your team uses one of our favorite tools in the D&R org! Can you tell us about BrainAuth and how it finds useful things?
• We talked about Google D&R (ep 17 and ep 75) and the role of automation came up many times. And automation is a key topic for a lot of our cloud customers. What do you automate in your domain of D&R?

Resources:

• “Hacking Google” videos  (EP00 with Mike)
• The Secure Reliable Systems book
• The CERT Guide to Insider Threats book
• Common Sense Guide to Mitigating Insider Threats book
• Insider Threats (Cornell Studies in Security Affairs)
• Foreign Espionage in Cyberspace from the NCSC
• “How We Scale Detection and Response at Google: Automation, Metrics, Toil” (ep75)
• “Modern Threat Detection at Google” (ep17)

Guest:

• Phil Venables, Vice President and CISO at Google Cloud

Topics:

• Google Cybersecurity Action Team is your brainchild and it is 1 year old, what comes to mind first when we reflect on this anniversary?
• The team is primarily about helping clients with security, what did we learn doing this for a year?
• What challenges have we (Google Cybersecurity Action Team) faced in our first year?
• We released 4 Threat Horizons reports this year, what is the future for this research here?
• We often hear that in the cloud we need to move away from products towards solutions, how does that work in security?
• Your famous 8 megatrends post is several months old - any new thoughts or changes coming to this concept?
• Recently you had a very interesting blog “Crucial Questions from CISOs and Security Teams”, with a list of questions, can you share some of your thinking here?

Resources:

• Security at Google Cloud Next 2022
• Next Special - Log4j Reflections, Software Dependencies and Open Source Security
• Next Special - Improving Browser Security in the New Era of Work
• Next Special - Can We Escape Ransomware by Migrating to the Cloud?
• NEXT Special - Google Cybersecurity Action Team: What's the Story? (Next 2021 special episode)
• Modernizing SOC ... Introducing Autonomic Security Operations 
• How autonomic data security can help define cloud’s future
• Google Cloud Threat Horizons Report #1 #2 #3 #4
• 8 Megatrends drive cloud adoption—and improve security for all
• “Demystify Data Sovereignty and Sovereign Cloud Secrets at Google Cloud” (ep81)
• Crucial Questions from CISOs and Security Teams
• Google Cybersecurity Action Team

Guest:   

• Nelly Kassem, Security and Compliance Specialist @ Google Cloud

Topics:

• Why did ransomware attacks become so popular?
• What type of organizations are targeted by ransomware?  Do these affect mostly the organizations with sub-par security?
• Ransomware has been raging since 2015 and shows few signs of subsiding. Why are these attacks still successful? 
• Do we see ransomware in the cloud? 
• Does migrating to the cloud protect you from ransomware?
• Which of Google Cloud tools are useful to fight ransomware?

Resources:

• Security at Google Cloud Next 2022
• Next Special - Log4j Reflections, Software Dependencies and Open Source Security
• Next Special - Improving Browser Security in the New Era of Work
• “Future of EDR: Is It Reason-able to Suggest XDR?” (ep29)
• “2021: Phishing is Solved?” (ep40)
• Mandiant M-Trends 2022
• Google Cloud Threat Horizons Report #1 #2 #3 #4

Guest:

• Fletcher Oliver, Chrome Browser Customer Engineer, Google

Topics:

• What is browser security? Isn’t it just application security by another name? 
• Why is browser security more important now than ever? 
• Do we have statistical measures or data that tell us if we’re succeeding at browser security? Do we know if we’re doing a good job at making this better? 
• What are the components of modern browser security? 
• How does this work with an enterprise’s existing stack? 
• In fact, how does this work with the rest of Google’s tooling? 

Resources:

• Security at Google Cloud Next 2022
• NEXT Special - Log4j Reflections, Software Dependencies and Open Source Security
• Chrome releases blog
• Chrome Enterprise

Guest:

• Dr Nicky Ringland, Product Manager for Open Source Insights, Google

Topics:

• Let's talk Open Source Software - are all these dependencies dependable?
• Why was log4j such a big thing - at a whole ecosystem level?
• Was it actually a Java / Maven problem? Are other languages “better” or more secure?
• Is another log4j inevitable? What can organizations to minimise their own risks?

 Resources:

• Google Cloud Next 2022
• Open Source Insights at deps.dev
• Blog at blog.deps.dev with posts on Understanding the Impact of Apache Log4j Vulnerability and what happens After the Advisory
• Assured Open Source Software service

Guest:

• Thiébaut Meyer, Director at Office of the CISO, Google Cloud

Topics:

• Virtualization's arrival caused a major IT upheaval 20 years ago. What can we learn from that revolution for our current cloud transformation?
• We talk about our three legged security stool of people/process/technology. How do we balance the technical issues (new technology stack, etc.) with the new processes (agile, etc) and the skills?
• What are the cultural and people transformation differences between the virtualization and cloud revolutions?
• We do recall how PCI DSS was disrupted by virtualization.  So, how does regulation play into this change - back then and now with the cloud?
• How do we change the minds of regulators who still think that cloud is a risk to mitigate, rather than a way to mitigate others risks better?

Resources:

• “8 Megatrends drive cloud adoption—and improve security for all” blog
• “Demystifying ‘shared Fate’ - A New Approach To Understand Cybersecurity”
• Transform with Google Cloud 
• Google Cybersecurity Action Team

Guest: 

• Steve McGhee, Reliability Advocate, Google Cloud

Topics:

• What can security teams  learn from the Site Reliability Engineering (SRE) art of rapid and safe deployment?
• Is this all about the process or do SREs possess some magical technology to do this?
• What is SRE approach to automation?
• What are the pillars / components of SRE approach to deployment?
• SRE is also about scaling. Some security teams have to manage 1000s of detection rules, how can this be done in a manner that does not conflict or cause other problems?

Resources:

• Google SRE book
• A companion Google SRE workbook
• “How We Scale Detection and Response at Google: Automation, Metrics, Toil” (ep75)
• “Achieving Autonomic Security Operations: Why metrics matter (but not how you think)” blog
• “Achieving Autonomic Security Operations: Reducing toil” blog.

Guest:

• Alex Polyakov, CEO of Adversa.ai

Topics:

• You did research by analyzing 2000 papers on AI attacks released in the previous decade. What are the main insights?
• How do you approach discovering the relevant threat models for various AI systems and scenarios? 
• Which threats are real today vs in a few years?
• What are the common attack vectors? What do you see in the field of supply chain attacks on AI, software supply, data?
• All these reported cyberphysical attacks on computer vision, how real are they, and what are the possible examples of exploitation? Are they a real danger to people?
• What are the main differences between protecting AI vs protecting traditional enterprise applications?
• Who should be responsible for Securing AI? What about for building trustworthy AI?
• Given that the machinery of AI is often opaque, how to go about discovering vulnerabilities? Is there responsible disclosure for AI vulnerabilities, such as in open-source models and in public APIs? 
• What should companies do first, when embarking on an AI security program? Who should have such a program?

Resources:

• “EP52 Securing AI with DeepMind CISO” (ep52)
• “EP68 How We Attack AI? Learn More at Our RSA Panel!” (ep68)
• Adversarial AI attacks work on Humans (!)
• “Maverick* Research: Your Smart Machine Has Been Conned! Now What?” (2015)
• “The Road to Secure and Trusted AI” by Adversa AI
• “Towards Trusted AI Week 37 – What are the security principles of AI and ML?” 
• Adversa AI blog
• AIAAIC Repository
• Machine Learning Security Evasion Competition at MLSec