Guest:

• John Stone, Chaos Coordinator at the Office of the CISO @ Google Cloud

Topics:

• What are the top European-specific cloud migration security challenges?
• Are there interesting cloud adoption barriers related to security in Europe?
• Are some of these challenges more compliance than security related?
• Do you think compliance still drives security in the cloud for European companies?
• Do you think Europe can ever "make their own cloud"?
• So, what do you make of this entire movement about "data sovereignty"?

Guests:

• Eric Brewer, VP of Infrastructure, and Google Fellow @ Google
• Aparna Sinha, Director of Product Management @ Google Cloud

Topics:

• What is software supply chain security and how is it different from other kinds of supply chain security?
• What types of organizations need to care about it? Is supply chain security a concern for large, elite enterprises only?
• What's the relationship between what we're doing here, and what SBOM is?
• Can you talk us through a quick threat assessment of a supply chain security issue? What are the realistic threats here and who are the threat actors involved?
• How does Google try to solve these problems internally? Have we succeeded?
• How does this translate into our products? By the way, what's SLSA?

Resources:

• "Container Security: Building trust in your software supply chain" (live event on July 29, 2021)
• "Tracking The Trail Of Software: The Key To Boosting Security"
• "Introducing SLSA, an End-to-End Framework for Supply Chain Integrity"
• DORA study

No guests. We interviewed each other!

Topics:

• What would you say are the most things that Chronicle is trying to address today?
• What are the good ways to use threat intel to detect threats that do not ruin your SOC?
• What does "autonomic" security mean, anyway? Is this a fancy way of saying "automatic" or something more?
• For sure, "the Cloud is not JUST someone else's computer" - but how does this apply to threat detection?
• What makes threat detection "cloud-native"?
• What kinds of ML magic does your mini UEBA inside SCC use?
• Can you really do automated remediation in the cloud?

Resources:

• Google Cloud Security Summit
• "Making Invisible Security a Reality with Google" keynote
• "Security Analytics at Google Speed and Scale" presentation by Anton
• "Managing Your Security Posture on Google Cloud" presentation by Tim
• "Stop Trying to Take Humans Out of SOC … Except … Wait… Wait… Wait…" blog
• Chronicle main site
• Threat Detection in Logs in Google Cloud SCC video
• "Modern Threat Detection at Google" (episode 17)
• "Automate and/or Die?" (episode 3)

Guests:

• Phil Venables (@philvenables), Vice President, Chief Information Security Officer (CISO) @ Google Cloud
• Dave Hannigan, Director, Financial Services Security & Compliance @ Google Cloud

Topics:

• As a CISO, would you ever decide to use multiple clouds, if it were in your hands?
• How is security typically considered when companies go multi-cloud in their approach?
• Practically, or operationally, how does one think through securing multiple public cloud environments?
• What are the top challenges here? Different controls? Lack of tools? Confusing process? Skills on the team?
• Would you always buy security tools from a 3rd party (not a CSP) if you have to cover more than one cloud provider?
• Anything to add about compliance across multiple clouds?
• What is the best approach for securing multiple SaaS services that your company uses?

Resources:

• "IDC: A multicloud strategy can mitigate regulatory, business risks"
• "Anthos security"
• SANS papers on securing multiple clouds (example)

Guest:

• Kelly Anderson, Head of Product Marketing, User Protection Services @ Google Cloud

Topics:

• What is marketing, really? Why is it sometimes reviled by the technologists?
• What makes a great marketer in cloud security?
• What's different about cloud security marketing, as opposed to regular old on-premise security marketing? Is there still FUD in the cloud?
• Which things are the easiest or hardest to do in Google Cloud Security marketing?
• How do you talk about products so they stand out from the noise?
• How's Google Cloud marketing helping our users stay ahead of the adversaries?

Resources:

• Security insights that help customers stay up to date
• Customer case studies on our security products
• Quarterly Google Cloud Security Talks
• Cloud security webinars on BrightTALK and Cloud OnAir
• Identity and security blogs on the Google Cloud blog

Guest:

• Heather Adkins, Sr Director, Information Security @ Google

Topics:

• Your RSA presentation has 3 pillars: zero trust, microservices, automation/zero prod, is this all you need to be secure & reliable in the modern world?
• Let's drill down again into the "secure and reliable" concept, are you sure that they are interrelated?
• Is there a risk that microservices could actually increase attack surface?
• What are the practical security upsides of "no touch production"?
• SRE and DevOps revolutionized IT, can we expect a similar revolution for security? Where would it come from?

Resources:

• "Building Secure and Reliable Systems" RSA 2021 presentation by Heather Adkins
• "Building Secure and Reliable Systems" book (free)
• "Modern Threat Detection at Google" (ep 17)
• Google BeyondCorp
• Google BeyondProd
• NIST 800-27 "Zero Trust Architecture"

Guest 1:

• Sparky Toews, Product Manager for Adobe identity @ Adobe

Topics 1:

• Why are bots a problem to you? Give us a bit of your bot threat assessment?
• Can you tell us how you think about and practice securing the user experience?
• What kind of security products or best practices are involved?
• How do you see what security professionals do to secure the user experience evolving over time?

Guests 2:

• Randy Gingeleski, Senior Staff Security Engineer @ HBO Max
• Brian Lozada, CISO @ HBO Max

Topics 2:

• Can you tell us how you think about and practice securing the user experience at HBO?
• What kind of security products or best practices are involved?
• How does reCAPTCHA Enterprise fit into all of this?
• How do you see what security professionals do to secure the user experience evolving over time?

Guests:

• Jane Chung, VP of Cloud @ Palo Alto
• Joe Crawford, Director of Strategic Technology Partnerships for Google Cloud @ Palo Alto

Topics:

• What are the top security mistakes you've seen during cloud migrations?
• What is your best advice to security leaders who want to go to the cloud using the on-premise playbook?
• What security technologies may no longer be needed in the cloud? Which are transformed by the cloud?
• Cloud often implies agility, but sometimes security slows things down, how to fix that?
• How do security needs change based on adoption architecture (cloud, hybrid with on-premise, multi-cloud, multi cloud with on-premise)?
• From a security perspective, is there really any such thing as "lift and shift"?
• How do we teach cloud to security leaders who "grew up" on-premise?

Resources:

• Use "Move and Improve" Instead of "Lift an Shift"
• "Data Security in the Cloud" (Episode 2)
• "The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age" book
• CSA CCM v4

Guest:

• Julien Vehent, Security Engineering Manager in the Detection and Response team @ Google

Topics:

• What is special about detecting modern threats in modern environments?
• How does the Google team turn the knowledge of threats into detection logic?
• Run through an example of creating a detection for a new threat?
• How do we test our detection rules?
• We use the same people to write detections and to respond to resulting alerts, how is it working?
• What are the key skills of good security analysts to build cloud threat detection?

Resources:

• "Site Reliability Engineering" book (free)
• "Building Secure & Reliable Systems" book (free)
• "Securing DevOps" by our very guest Julien Vehent

Guests:

• Tim Dierks, Engineering Director, Data Protection @ Google Cloud

Topics:

• What are the key components of data security in the public cloud today?
• Why do companies need specific data security plans and products?
• Do you think Google Cloud today has enough controls for processing the most sensitive data?
• Many organizations seem to be unaware of where sensitive data exists in their cloud environments, how do you think this problem will be fixed?
• What is your view on encryption's role in future cloud security?
• Do organizations mostly encrypt for security or for compliance?
• How do we help companies navigate the tradeoffs between complying with nation-state regulations and best practices for availability?
• I hear you are involved with some interesting key management innovations like HYOK via Cloud EKM, why do these matter for clients today?

Resources:

• Forrester report "The Forrester Wave™: Unstructured Data Security Platforms, Q2 2021"
• "New whitepaper: Designing and deploying a data security strategy with Google Cloud"
• "Hold your own key with Google Cloud External Key Manager"
• "Building Secure and Resilient Systems" book (free)