By Cloud Security Podcast Team
5
5252 ratings
The podcast currently has 276 episodes available.
How does Edge Security fit into the future of Cloud Protection ? In this episode, we sat down with Brian McHenry, Global Head of Cloud Security Engineering at Check Point at BlackHat USA, to chat about the evolving landscape of cloud security in 2024. With cloud adoption accelerating and automation reshaping how we manage security, Brian spoke to us about the challenges that organizations face today—from misconfigurations and alert fatigue to the role of AI in application security.
We tackle the question: Is CSPM (Cloud Security Posture Management) still enough, or do we need to rethink our approach? Brian shares his thoughts on edge security, why misconfigurations are more dangerous than ever, and how automation can quickly turn small risks into significant threats.
Guest Socials: Brian's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(03:28) State of Cloud Market
(04:44) Is CSPM not enough?
(06:35) Edge Security in Cloud Context
(08:31) Where is edge security going?
(10:11) Where to start with Cloud Security Tooling?
(11:08) Transitioning from Network Security to Cloud Security
(13:11) How is AI Changing Edge Security?
(14:45) How is WAF and DDos Protection evolving?
(18:16) Should people be doing network pentest?
(19:57) North Star for WAF in a cybersecurity program
(20:55) The evolution to platformization
(23:13) Highlight from BlackHat USA 2024
How CI/CD Tools can expose your Code to Security Risks? In this episode, we’re joined by Mike Ruth, Senior Staff Security Engineer at Rippling and returning guest, live from BlackHat 2024. Mike dives deep into his research on CI/CD pipeline security, focusing on popular tools like GitHub Actions, Terraform, and Buildkite. He reveals the hidden vulnerabilities within these tools, such as the ability for engineers to bypass code reviews, modify configuration files, and run unauthorized commands in production environments.
Mike explains how the lack of granular access control in repositories and CI/CD configurations opens the door to serious security risks. He shares actionable insights on how to mitigate these issues by using best practices like GitHub Environments and Buildkite Clusters, along with potential solutions like static code analysis and granular push rule sets. This episode provides critical advice on how to better secure your CI/CD pipelines and protect your organization from insider threats and external attacks.
Guest Socials: Mike's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introductions
(01:56) A word from episode sponsor - ThreatLocker
(02:31) A bit about Mike Ruth
(03:08) SDLC in 2024
(08:05) Mitigating Challenges in SDLC
(09:10) What is Buildkite?
(10:11) Challenges observed with Buildkite
(12:30) How Terraform works in the SDLC
(15:41) Where to start with these CICD tools?
(18:55) Threat Detection in CICD Pipelines
(21:31) Building defensive libraries
(23:58) Scaling solutions across multiple repositories
(25:46) The Fun Questions
Resources mentioned during the call:
GitHub Actions
Terraform
Buildkite
Mike's BSidesSF Talk
In this episode of the Cloud Security Podcast, we bring together an incredible panel of experts to explore the evolving landscape of cloud security in 2024. Hosted by Ashish Rajan, the discussion dives deep into the challenges and realities of today’s multi-cloud environments. With perspectives ranging from seasoned veterans to emerging voices this episode offers a broad spectrum of insights from cloud security practitioners who are living and breathing cloud security everyday. We are very grateful to our panelist who took part in 1st of its kind edition for the State of Cloud Security - Meg Ashby, Damien Burks, Chris Farris, Rich Mogull, Patrick Sanders, Ammar Alim and Abdie Mohamed.
The conversation covers essential topics such as the pitfalls of multi-cloud adoption, the persistent security issues that remain even as cloud technologies advance, and the importance of specializing in one cloud platform while maintaining surface-level knowledge of others. The panelists also share their thoughts on the future of cloud security, including the increasing relevance of Kubernetes and edge security.
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(02:22) How much has Cloud Security Changed?
(07:05) Is the expectation to be MultiCloud?
(19:07) What’s top of mind in Cloud Security in 2024?
(27:17) The current Cloud Service Provider Landscape
(39:26) Where to start in Cloud Security ?
(52:10) The Fun Section
Resources discussed during the episode:
fwd:cloudsec conference
Cloud Security Bootcamp
DevSecBlueprint YouTube Channel - Damien Burks
Rich Mogull’s Cloud Security Lab of the Week
What were the main themes at BlackHat USA 2024? With respect to Cloud Security, maybe with a sprinkle of AI Security. Our team was on the ground at BlackHat and DefCon32 this year, we heard many talks and panels, spoke to many practitioner, leaders and CISOs and had the pleasure of recording some great interviews (coming soon!). This conversation is a distillation of everything we heard and the themes we saw.
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:15) A word from our episode sponsor, ThreatLocker
(04:35) Resiliency in Cybersecurity
(07:00) Commentary on upcoming US elections
(09:42) Identity Centric Security
(15:55) Cloud Security is getting more Complex
(23:47) Growing importance of Data Security
(25:42) Use Cases for AI Security
(31:25) Shared Responsibility and Shared Fate
(33:21) Is CSPM Dead?
(37:32) The Conclusion
Resources from the episode:
BlackHat USA Keynote - Democracy's Biggest Year: The Fight for Secure Elections Around the World
Generative AI Misuse: A Taxonomy of Tactics
RSAC 2024 Innovation Sandbox Finalist
BlackHat USA 2024 Startup Spotlight
In this episode, we sit down with Santiago, a Senior Security Engineer at Canva, to talk about the complexities of building and managing an incident response team, especially in high-growth companies. Santiago shares his experience transitioning from penetration testing to incident response and highlights the unique challenges that come with protecting a rapidly expanding organization.
We explore the differences between incident response in high-growth versus established companies, the importance of having the right personnel, and the critical skills needed for effective incident response.
Guest Socials: Santiago's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:58) A word from our sponsor - SentinelOne
(02:48) A bit about Santiago
(03:18) What is Incident Response?
(04:06) How IR differs in different organisations?
(04:48) Red Team vs Incident Response Team
(06:17) Challenges for Incident Response in Cloud
(07:16) Incident Response in a High Growth Company
(07:56) Skillsets required for high growth
(09:14) Cloud vs On Prem Incident Response
(10:03) Building Incident Response in High Growth Company
(11:39) Responding to incidents that are not high risk
(14:41) Transition from pentesting to incident responder
(17:20) Endpoint vulnerability management at scale
(25:32) The Fun Section
Resources from the episode:
Endpoint Vulnerability Management at Scale
Leadership Insights on Cloud Security in 2024. Ashish sat down with return guest Srinath Kuruvadi, a seasoned cloud security leader with over two decades of experience in the field. Together, they explored the current state and future of cloud security, discussing the importance of detection & incident response teams, building and maintaining a robust cloud security program, understanding the importance of stakeholder management, and the role of data security in mitigating risks. Srinath shared his perspective on the evolution of cloud security, the critical need for a prevention-first mindset while tackling the challenges of managing security in a multi-cloud environment
Guest Socials: Srinath's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:42) A bit about Srinath
(01:55) How has the Cloud Security space changed?
(05:27) Are CloudSec and AppSec merging?
(06:29) Are stakeholders more engaged with Cloud Security?
(08:10) Where are the boundaries for Cloud Security?
(10:06) Finding the right talent in Cloud Security
(12:31) Building a Multi Cloud Security Team
(15:06) The role of platform teams
(16:45) Maturity level for Cloud Security
(19:18) Current patterns in Cloud Security
(22:03) What should CSPs be taking more about?
What are you doing differently today that you're stopping tomorrow's legacy? In this episode Ashish spoke to Adrian Asher, CISO and Cloud Architect at Checkout.com, to explore the journey from monolithic architecture to cloud-native solutions in a regulated fintech environment. Adrian shared his perspective on why there "aren't enough lambdas" and how embracing cloud-native technologies like AWS Lambda and Fargate can enhance security, scalability, and efficiency.
Guest Socials: Adrian's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:59) A bit about Adrian
(02:47) Cloud Naive vs Cloud Native
(03:54) Checkout’s Cloud Native Journey
(05:44) What is AWS Fargate?
(06:52) There are not enough Lambdas
(09:52) The evolution of the Security Function
(12:15) Culture change for being more cloud native
(15:23) Getting security teams ready for Gen AI
(18:16) Where to start with Cloud Native?
(19:14) Where you can connect with Adrian?
(19:39) The Fun Section
How to secure AWS cloud using AWS Lambda? We spoke to Lily Chau from Roku at BSidesSF about her experience and innovative approach to tackling security issues in AWS environments. From deploying IAM roles to creating impactful playbooks with AWS Lambda, Lily shared her take on automating remediation processes. We spoke about the challenges of managing cloud security with tools like CSPM and CNAPP, and how Lily and her team took a different approach that goes beyond traditional methods to achieve real-time remediation.
Guest Socials: Lily Twitter
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:56) A bit about Lily
(02:27) What is Auto Remediation?
(03:56) Example of Auto Remediation
(05:19) CSPMs and Auto Remediation
(06:58) Make Auto Remediation in Cloud work for you
(09:49) Where to get started with Auto Remediation?
(11:52) What defines a High Impact Playbook?
(12:58) Auto Remediation for Lateral Movement
(14:35) What is running in the background?
(16:41) What skillset is required?
(19:08) The Fun Section
Resources for the episode:
Lily's talk at BsidesSF
How can you protect your data with Confidential Compute and Containers? Ashish spoke to Zvonko Kaiser, Principal Systems Software Engineer, Confidential Containers and Kubernetes at Nvidia about confidential containers, confidential computing, and their importance in protecting sensitive data. They speak about the various threat models, use cases, and the role of GPUs in enhancing compute power for AI workloads
Guest Socials: Zvonko's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:45) A word from our sponsor SentinelOne
(02:18) A bit about Zvonko
(02:24) Encryption for Confidential Computing
(04:20) Confidential Computing vs Confidential Containers
(05:45) What sectors focus on Confidential Computing?
(07:09) Common Threats in Confidential Computing
(08:55) What is a Secure Enclave?
(10:05) Value of Attestation for Confidential Computing
(11:35) Lift and Shift Strategy for AI
(13:59) The role of GPU in confidential Computing
(15:37) Shared Responsibility with Confidential Computing
(17:10) Confidential Computing project you can get involved in
(18:16) The fun section
How to implement infrastructure as code? Ashish spoke to Armon Dadgar. Co-Founder and CTO at HashiCorp at Hashidays London. Armon speaks about his journey from co-creating Terraform, the first open-source language in the IaC space, to addressing the complex challenges enterprises face in cloud environments today. They speak about why having a platform team from the beginning is crucial for large enterprises, the evolution of IaC, the importance of standardization in managing cloud applications, and how automation plays a key role in maintaining security.
Guest Socials: Armon's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
00:00 Introduction
01:54 A bit about Armon
02:32 How has infrastructure as code evolved?
03:43 The role of Terraform
04:38 Infrastructure and Security Lifecycle Management
06:51 Best Practice for Infrastructure Lifecycle Management
09:11 Best Practice for Security Lifecycle Management
09:38 What is a Platform Team?
11:02 When should people start thinking about a platform team?
13:02 What is Zero Trust?
14:52 Challenges with IaC
17:35 How GenAI is impacting IaC?
20:04 Starting an open source project?
24:53 The Fun Section
The podcast currently has 276 episodes available.
353 Listeners
606 Listeners
152 Listeners
982 Listeners
200 Listeners
58 Listeners
360 Listeners
135 Listeners
175 Listeners
182 Listeners
300 Listeners
65 Listeners
102 Listeners
34 Listeners
30 Listeners