Guest host:

• Marina Kaganovich, Executive Trust Lead, Office of the CISO @ Google Cloud

Guest:

• John Rogers, CISO @ MSCI

Topics:

• Can you briefly walk us through your CISO career path?
• What are some of the key (cloud or otherwise) trends that CISOs should be keeping an eye on? What is the time frame for them?
• What are the biggest cloud security challenges CISOs are facing today, and how are those evolving?
• Given the rapid change of pace in emerging tech, such as what we've seen in the last year or so with gen AI, how do you balance the need to address short-term or imminent issues vs those that are long-term or emergent risks?
• What advice do you have for how CISOs can communicate the importance of anticipating threats to their boards and executives?
• So, how to be a forward looking and strategic yet not veer into dreaming, paranoia and imaginary risks? How to be futuristic yet realistic?
• The CISO role as an official title is a relatively new one, what steps have you taken to build credibility and position yourself for having a seat at the table?

Resources:

• ATT&CK Framework
• EP189 How Google Does Security Programs at Scale: CISO Insights
• EP129 How CISO Cloud Dreams and Realities Collide
• EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!
• EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?

Guest:

• Bob Blakley, Co-founder and Chief Product Officer of Mimic

Topics:

• Tell us about the ransomware problem - isn't this a bit of old news? Circa 2015, right?
• What makes ransomware a unique security problem?
• What's different about ransomware versus other kinds of malware? What do you make of the "RansomOps" take (aka "ransomware is not malware")?
• Are there new ways to solve it?
• Is this really a problem that a startup is positioned to solve? Aren't large infrastructure owners better positioned for this? In fact, why haven't existing solutions solved this?
• Is this really a symptom of a bigger problem? What is that problem?
• What made you personally want to get into this space, other than the potential upside of solving the problem?

Resources:

• EP206 Paying the Price: Ransomware's Rising Stakes in the Cloud
• EP89 Can We Escape Ransomware by Migrating to the Cloud?
• EP45 VirusTotal Insights on Ransomware Business and Technology
• EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators
• EP7 No One Expects the Malware Inquisition
• Anderson Report (July 1972)
• "The Innovator Dilemma" book
• "Odyssey" book (yes, really)
• Crowdstrike External Technical Root Cause Analysis — Channel File 291 (yes, that one)

Guest:

• Allan Liska, CSIRT at Recorded Future, now part of Mastercard

Topics:

• Ransomware has become a pervasive threat. Could you provide us with a brief overview of the current ransomware landscape?
• It's often said that ransomware is driven by pure profit. Can you remind us of the business model of ransomware gangs, including how they operate, their organizational structures, and their financial motivations?
• Ransomware gangs are becoming increasingly aggressive in their extortion tactics. Can you shed some light on these new tactics, such as data leaks, DDoS attacks, and threats to contact victims' customers or partners?
• What specific challenges and considerations arise when dealing with ransomware in cloud environments, and how can organizations adapt their security strategies to mitigate these risks?
• What are the key factors to consider when deciding whether or not to pay the ransom?
• What is the single most important piece of advice you would give to organizations looking to bolster their defenses against ransomware?

Resources:

• Video (LinkedIn, YouTube)
• 2024 Data Breach Investigations Report
• EP89 Can We Escape Ransomware by Migrating to the Cloud?
• EP45 VirusTotal Insights on Ransomware Business and Technology
• EP29 Future of EDR: Is It Reason-able to Suggest XDR?
• EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators

Guest:

• Andrew Kopcienski, Principal Intelligence Analyst, Google Threat Intelligence Group

Questions:

• You have this new Cybersecurity Forecast 2025 report, what's up with that?
• We are getting a bit annoyed about the fear-mongering on "oh, but attackers will use AI." You are a threat analyst, realistically, how afraid are you of this?
• The report discusses the threat of compromised identities in hybrid environments (aka "no matter what you do, and where, you are hacked via AD"). What steps can organizations take to mitigate the risk of a single compromised identity leading to a significant security breach? Is this expected to continue?
• Is zero-day actually growing? The report seems to imply that, but aren't "oh-days" getting more expensive every day?
• Many organizations still lag with detection, in your expertise, what approaches to detection actually work today? It is OK to say "hire Managed Defense", BTW :-)
• We read the risk posed by the "Big Four" sections and they (to us) read like "hackers hack" and "APTs APT." What is genuinely new and interesting here?

Resources:

• Cybersecurity Forecast 2025 report
• Google Cloud Cybersecurity Forecast 2025 webinar
• EP147 Special: 2024 Security Forecast Report
• EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side
• EP153 Kevin Mandia on Cloud Breaches: New Threat Actors, Old Mistakes, and Lessons for All
• Staying a Step Ahead: Mitigating the DPRK IT Worker Threat

Guest:

• Phil Venables, Vice President, Chief Information Security Officer (CISO) @ Google Cloud

Topics

• Why is our industry suddenly obsessed with resilience? Is this ransomware's doing?
• How did the PCAST report come to be? Can you share the backstory and how it was created?
• The PCAST report emphasizes the importance of leading indicators for security and resilience. How can organizations effectively shift their focus from lagging indicators to these leading indicators?
• The report also emphasizes the importance of "Cyber-Physical Modularity" - this sounds mysterious to us, and probably our listeners! What is it and how does this concept contribute to enhancing the resilience of critical infrastructure?
• The report advocates for regular and rigorous stress testing. How can organizations effectively implement such stress testing to identify vulnerabilities and improve their resilience?
• In your opinion, what are the most critical takeaways from our PCAST-related paper for organizations looking to improve their security and resilience posture today?
• What are some of the challenges organizations might face when implementing the PCAST recommendations, and how can they overcome these challenges?
• Do organizations get resilience benefits "for free" by using Google Cloud?

Resources:

• 10 ways to make cyber-physical systems more resilient
• "Cyber-Physical Resilience and the Cloud: Putting the White House PCAST report into practice" report
• Megatrends drive cloud adoption—and improve security for all
• EP163 Cloud Security Megatrends: Myths, Realities, Contentious Debates and Of Course AI
• Advising The President On Cyber-Physical Resilience - Philip Venables (at PSW)
• EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
• EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side

Guest:

• Rich Mogull, SVP of Cloud Security at Firemon and CEO at Securosis

Topics:

• Let's talk about cloud security shared responsibility. How to separate the blame? Is there a good framework for apportioning blame?
• You've introduced the Cloud Shared Irresponsibilities Model, stating cloud providers will be considered partially responsible for breaches even if due to customer misconfigurations. How do you see this impacting the relationship between cloud providers and their customers? Will it lead to more collaboration or more friction?
• We both know the Jay Heiser 2015 classic "cloud is secure, but you not using it securely." In your view, what does "use cloud securely" mean for various organizations today?
• Here is a very painful question: how to decide what cloud security should be free with cloud and what security can be paid?
• You dealt with cloud security for a long time, what is your #1 lesson so far on how to make the cloud more secure or use the cloud more securely?
• What is the best way to learn how to cloud? What is this CloudSLAW thing?

Resources:

• EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
• The Cloud Shared Irresponsibilities Model
• 2002 Trustworthy computing memo
• Use Cloud Securely? What Does This Even Mean?!
• EP145 Cloud Security: Shared Responsibility, Shared Fate, Shared Faith?
• No Snow, No Flakes: Pondering Cloud Security Shared Responsibility, Again!
• Cloud Security Lab a Week (S.L.A.W)
• Megatrends drive cloud adoption—and improve security for all
• Shared fate main page
• Defining the Journey—the Four Cloud Adoption Patterns
• Celebrating 200 Episodes of Cloud Security Podcast by Google and Thanks for all the Listens!

Guest:

• Amine Besson, Tech Lead on Detection Engineering, Behemoth Cyberdefence

Topics:

• What is your best advice on detection engineering to organizations who don't want to engineer anything in security?
• What is the state of art when it comes to SOC ? Who is doing well? What on Earth is a fusion center?
• Why classic "tiered SOCs" fall flat when dealing with modern threats?
• Let's focus on a correct definition of detection as code. Can you provide yours?
• Detection x response engineering - is there a thing called "response engineering"? Should there be?
• What are your lessons learned to fuse intel, detections, and hunting ops?
• What is this SIEMless yet SOARful detection architecture?
• What's next with OpenTIDE 2.0?

Resources:

• Guide your SOC Leaders to More Engineering Wisdom for Detection (Part 9) and other parts linked there
• Hack.lu 2023: TIDeMEC : A Detection Engineering Platform Homegrown At The EC video
• OpenTIDE · GitLab
• OpenTIDE 1.0 Release blog
• SpectreOps blog series 'on detection'
• Does your SOC have NOC DNA? presentation
• Kill SOC Toil, Do SOC Eng blog (tame version)
• The original ASO paper (2021, still epic!)
• Behind the Scenes with Red Canary's Detection Engineering Team
• The DFIR Report – Real Intrusions by Real Attackers, The Truth Behind the Intrusion
• Site Reliability Engineering (SRE) | Google Cloud

Guest:

• Chris Hoff, Chief Secure Technology Officer at Last Pass

Topics:

• I learned that you have a really cool title that feels very "now" - Chief Secure Technology Officer? What's the story here? Weirdly, I now feel that every CTO better be a CSTO or quit their job :-)
• After, ahem, not-so-recent events you had a chance to rebuild a lot of your stack, and in the process improve security. Can you share how it went, and what security capabilities are now built in?
• How much of a culture change did that require? Was it purely a technological transformation or you had to change what people do and how they do it?
• Would you recommend this to others (not the "recent events experience", but the rebuild approach)? What benefits come from doing this before an incident occurs? Are there any?
• How are you handling telemetry collection and observability for security in the new stack? I am curious how this was modernized
• Cloud is simple, yet also complex, I think you called it "simplex." How does this concept work?

Resources:

• Video (LinkedIn, YouTube)
• EP189 How Google Does Security Programs at Scale: CISO Insights
• EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!
• EP80 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?
• EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?

Guest:

• Michael Czapinski, Security & Reliability Enthusiast, Google

Topics:

• "How Google protects its production services" paper covers how Google's infrastructure balances several crucial aspects, including security, reliability, development speed, and maintainability. How do you prioritize these competing demands in a real-world setting?
• What attack vectors do you consider most critical in the production environment, and how has Google's defenses against these vectors improved over time?
• Can you elaborate on the concept of Foundational services and their significance in Google's security posture?
• How does your security approach adapt to this vast spectrum of sensitivity and purpose of our servers and services, actually?
• How do you implement this principle of zero touch prod for both human and service accounts within our complex infrastructure?
• Can you talk us through the broader approach you take through Workload Security Rings and how this helps?

Resources:

• "How Google protects its production services" paper (deep!)
• SLSA framework
• EP189 How Google Does Security Programs at Scale: CISO Insights
• EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!
• EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use
• EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
• SREcon presentation on zero touch prod.
• The SRS book (free access)

Guests:

• Michele Chubirka, Staff Cloud Security Advocate, Google Cloud
• Sita Lakshmi Sangameswaran, Senior Developer Relations Engineer, Google Cloud

Topics:

• What is your reaction to "in the cloud you are one IAM mistake away from a breach"? Do you like it or do you hate it? Or do you "it depends" it? :-)
• Everyone's talking about how "identity is the new perimeter" in the cloud. Can you break that down in simple terms?
• A lot of people say "in the cloud, you must do IAM 'right'". What do you think that means? What is the first or the main idea that comes to your mind when you hear it?
• What's this stuff about least-privilege and separation-of-duties being less relevant? Why do they matter in the cloud that changes rapidly?
• What are your IAM Top Pet Peeves?

Resources:

• Video (LinkedIn, YouTube)
• EP127 Is IAM Really Fun and How to Stay Ahead of the Curve in Cloud IAM?
• EP162 IAM in the Cloud: What it Means to Do It 'Right' with Kat Traxler
• IAM: There and back again using resource hierarchies
• IAM so lost: A guide to identity in Google Cloud
• I Hate IAM: but I need it desperately
• EP33 Cloud Migrations: Security Perspectives from The Field
• EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use
• EP177 Cloud Incident Confessions: Top 5 Mistakes Leading to Breaches from Mandiant
• EP188 Beyond the Buzzwords: Identity's True Role in Cloud and SaaS Security
• "Identity Crisis: The Biggest Prize in Security" paper
• "Learn to love IAM: The most important step in securing your cloud infrastructure" Next presentation