Player FM - Internet Radio Done Right
48 subscribers
Checked 3d ago
dört yıl önce eklendi
İçerik Anton Chuvakin tarafından sağlanmıştır. Bölümler, grafikler ve podcast açıklamaları dahil tüm podcast içeriği doğrudan Anton Chuvakin veya podcast platform ortağı tarafından yüklenir ve sağlanır. Birinin telif hakkıyla korunan çalışmanızı izniniz olmadan kullandığını düşünüyorsanız burada https://tr.player.fm/legal özetlenen süreci takip edebilirsiniz.
Player FM - Podcast Uygulaması
Player FM uygulamasıyla çevrimdışı Player FM !
Player FM uygulamasıyla çevrimdışı Player FM !
Dinlemeye Değer Podcast'ler
SPONSOR
S
State Secrets: Inside The Making Of The Electric State


1 Family Secrets: Chris Pratt & Millie Bobby Brown Share Stories From Set 22:08
22:08
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi22:08
Host Francesca Amiker sits down with directors Joe and Anthony Russo, producer Angela Russo-Otstot, stars Millie Bobby Brown and Chris Pratt, and more to uncover how family was the key to building the emotional core of The Electric State . From the Russos’ own experiences growing up in a large Italian family to the film’s central relationship between Michelle and her robot brother Kid Cosmo, family relationships both on and off of the set were the key to bringing The Electric State to life. Listen to more from Netflix Podcasts . State Secrets: Inside the Making of The Electric State is produced by Netflix and Treefort Media.…
EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
Manage episode 453230669 series 2892548
İçerik Anton Chuvakin tarafından sağlanmıştır. Bölümler, grafikler ve podcast açıklamaları dahil tüm podcast içeriği doğrudan Anton Chuvakin veya podcast platform ortağı tarafından yüklenir ve sağlanır. Birinin telif hakkıyla korunan çalışmanızı izniniz olmadan kullandığını düşünüyorsanız burada https://tr.player.fm/legal özetlenen süreci takip edebilirsiniz.
Guest:
Chris Hoff, Chief Secure Technology Officer at Last Pass
Topics:
- I learned that you have a really cool title that feels very “now” - Chief Secure Technology Officer? What’s the story here? Weirdly, I now feel that every CTO better be a CSTO or quit their job :-)
- After, ahem, not-so-recent events you had a chance to rebuild a lot of your stack, and in the process improve security. Can you share how it went, and what security capabilities are now built in?
- How much of a culture change did that require? Was it purely a technological transformation or you had to change what people do and how they do it?
- Would you recommend this to others (not the “recent events experience”, but the rebuild approach)? What benefits come from doing this before an incident occurs? Are there any?
- How are you handling telemetry collection and observability for security in the new stack? I am curious how this was modernized
- Cloud is simple, yet also complex, I think you called it “simplex.” How does this concept work?
Resources:
- Video (LinkedIn, YouTube)
- EP189 How Google Does Security Programs at Scale: CISO Insights
- EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!
- EP80 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?
- EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?
218 bölüm
Manage episode 453230669 series 2892548
İçerik Anton Chuvakin tarafından sağlanmıştır. Bölümler, grafikler ve podcast açıklamaları dahil tüm podcast içeriği doğrudan Anton Chuvakin veya podcast platform ortağı tarafından yüklenir ve sağlanır. Birinin telif hakkıyla korunan çalışmanızı izniniz olmadan kullandığını düşünüyorsanız burada https://tr.player.fm/legal özetlenen süreci takip edebilirsiniz.
Guest:
Chris Hoff, Chief Secure Technology Officer at Last Pass
Topics:
- I learned that you have a really cool title that feels very “now” - Chief Secure Technology Officer? What’s the story here? Weirdly, I now feel that every CTO better be a CSTO or quit their job :-)
- After, ahem, not-so-recent events you had a chance to rebuild a lot of your stack, and in the process improve security. Can you share how it went, and what security capabilities are now built in?
- How much of a culture change did that require? Was it purely a technological transformation or you had to change what people do and how they do it?
- Would you recommend this to others (not the “recent events experience”, but the rebuild approach)? What benefits come from doing this before an incident occurs? Are there any?
- How are you handling telemetry collection and observability for security in the new stack? I am curious how this was modernized
- Cloud is simple, yet also complex, I think you called it “simplex.” How does this concept work?
Resources:
- Video (LinkedIn, YouTube)
- EP189 How Google Does Security Programs at Scale: CISO Insights
- EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!
- EP80 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Does the Risk Change?
- EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?
218 bölüm
Tüm bölümler
×C
Cloud Security Podcast by Google

1 EP217 Red Teaming AI: Uncovering Surprises, Facing New Threats, and the Same Old Mistakes? 23:11
23:11
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi23:11
Guest: Alex Polyakov , CEO at Adversa AI Topics: Adversa AI is known for its focus on AI red teaming and adversarial attacks. Can you share a particularly memorable red teaming exercise that exposed a surprising vulnerability in an AI system? What was the key takeaway for your team and the client? Beyond traditional adversarial attacks, what emerging threats in the AI security landscape are you most concerned about right now? What trips most clients, classic security mistakes in AI systems or AI-specific mistakes? Are there truly new mistakes in AI systems or are they old mistakes in new clothing? I know it is not your job to fix it, but much of this is unfixable, right? Is it a good idea to use AI to secure AI? Resources: EP84 How to Secure Artificial Intelligence (AI): Threats, Approaches, Lessons So Far AI Red Teaming Reasoning LLM US vs China: Jailbreak Deepseek, Qwen, O1, O3, Claude, Kimi Adversa AI blog Oops! 5 serious gen AI security mistakes to avoid Generative AI Fast Followership: Avoid These First Adopter Security Missteps…
C
Cloud Security Podcast by Google

1 EP216 Ephemeral Clouds, Lasting Security: CIRA, CDR, and the Future of Cloud Investigations 31:43
31:43
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi31:43
Guest: James Campbell , CEO, Cado Security Chris Doman , CTO, Cado Security Topics: Cloud Detection and Response (CDR) vs Cloud Investigation and Response Automation( CIRA ) ... what’s the story here? There is an “R” in CDR, right? Can’t my (modern) SIEM/SOAR do that? What about this becoming a part of modern SIEM/SOAR in the future? What gets better when you deploy a CIRA (a) and your CIRA in particular (b)? Ephemerality and security, what are the fun overlaps? Does “E” help “S” or hurts it? What about compliance? Ephemeral compliance sounds iffy… Cloud investigations, what is special about them? How does CSPM intersect with this? Is CIRA part of CNAPP? A secret question, need to listen for it! Resources: EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud EP67 Cyber Defense Matrix and Does Cloud Security Have to DIE to Win? EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics Cloud security incidents (Rami McCarthy) Cado resources…
C
Cloud Security Podcast by Google

1 EP215 Threat Modeling at Google: From Basics to AI-powered Magic 26:03
26:03
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi26:03
Guest: Meador Inge , Security Engineer, Google Cloud Topics: Can you walk us through Google's typical threat modeling process? What are the key steps involved? Threat modeling can be applied to various areas. Where does Google utilize it the most? How do we apply this to huge and complex systems? How does Google keep its threat models updated? What triggers a reassessment? How does Google operationalize threat modeling information to prioritize security work and resource allocation? How does it influence your security posture? What are the biggest challenges Google faces in scaling and improving its threat modeling practices? Any stories where we got this wrong? How can LLMs like Gemini improve Google's threat modeling activities? Can you share examples of basic and more sophisticated techniques? What advice would you give to organizations just starting with threat modeling? Resources: EP12 Threat Models and Cloud Security EP150 Taming the AI Beast: Threat Modeling for Modern AI Systems with Gary McGraw EP200 Zero Touch Prod, Security Rings, and Foundational Services: How Google Does Workload Security EP140 System Hardening at Google Scale: New Challenges, New Solutions Threat Modeling manifesto EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use Awesome Threat Modeling Adam Shostack “Threat Modeling: Designing for Security” book Ross Anderson “Security Engineering” book ”How to Solve It” book…
C
Cloud Security Podcast by Google

1 EP214 Reconciling the Impossible: Engineering Cloud Systems for Diverging Regulations 29:22
29:22
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi29:22
Guest: Archana Ramamoorthy , Senior Director of Product Management, Google Cloud Topics: You are responsible for building systems that need to comply with laws that are often mutually contradictory. It seems technically impossible to do, how do you do this? Google is not alone in being a global company with local customers and local requirements. How are we building systems that provide local compliance with global consistency in their use for customers who are similar in scale to us? Originally, Google had global systems synchronized around the entire planet–planet scale supercompute–with atomic clocks. How did we get to regionalized approach from there? Engineering takes a long time. How do we bring enough agility to product definition and engineering design to give our users robust foundations in our systems that also let us keep up with changing and diverging regulatory goals? What are some of the biggest challenges you face working in the trusted cloud space? Is there something you would like to share about being a woman leader in technology? How did you overcome the related challenges? Resources: Video “Compliance Without Compromise” by Jeanette Manfra (2020, still very relevant!) “Good to Great” book “Appreciative Leadership” book…
C
Cloud Security Podcast by Google

1 EP213 From Promise to Practice: LLMs for Anomaly Detection and Real-World Cloud Security 28:01
28:01
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi28:01
Guest: Yigael Berger , Head of AI, Sweet Security Topic: Where do you see a gap between the “promise” of LLMs for security and how they are actually used in the field to solve customer pains? I know you use LLMs for anomaly detection. Explain how that “trick” works? What is it good for? How effective do you think it will be? Can you compare this to other anomaly detection methods? Also, won’t this be costly - how do you manage to keep inference costs under control at scale? SOC teams often grapple with the tradeoff between “seeing everything” so that they never miss any attack, and handling too much noise. What are you seeing emerge in cloud D&R to address this challenge? We hear from folks who developed an automated approach to handle a reviews queue previously handled by people. Inevitably even if precision and recall can be shown to be superior, executive or customer backlash comes hard with a false negative (or a flood of false positives). Have you seen this phenomenon, and if so, what have you learned about handling it? What are other barriers that need to be overcome so that LLMs can push the envelope further for improving security? So from your perspective, LLMs are going to tip the scale in whose favor - cybercriminals or defenders? Resource: EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud EP194 Deep Dive into ADR - Application Detection and Response EP135 AI and Security: The Good, the Bad, and the Magical Andrej Karpathy series on how LLMs work Sweet Security blog…
C
Cloud Security Podcast by Google

1 EP212 Securing the Cloud at Scale: Modern Bank CISO on Metrics, Challenges, and SecOps 33:16
33:16
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi33:16
Guest: Dave Hannigan , CISO at Nu Bank Topics: Tell us about the challenges you're facing as CISO at NuBank and how are they different from your past life at Spotify? You're a big cloud based operation - what are the key challenges you're tracking in your cloud environments? What lessons do you wish you knew back in your previous CISO run [at Spotify]? What metrics do your team report for you to understand the security posture of your cloud environments? How do you know “your” cloud use is as secure as you want it to be? You're a former Googler, and I'm sure that's not why, so why did you choose to go with Google SecOps for your organization? Resources: “Moving shields into position: How you can organize security to boost digital transformation” blog and the paper . “For a successful cloud transformation, change your culture first” blog “Is your digital transformation secure? How to tell if your team is on the right path” ’ blog EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen! EP141 Cloud Security Coast to Coast: From 2015 to 2023, What's Changed and What's the Same? EP209 vCISO in the Cloud: Navigating the New Security Landscape (and Don’t Forget Resilience!) “Thinking Fast and Slow” book “Turn the Ship Around” book…
C
Cloud Security Podcast by Google

1 EP211 Decoding the Underground: Google's Dual-Lens Threat Intelligence Magic 26:02
26:02
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi26:02
Guest: Kimberly Goody , Head of Intel Analysis and Production, Google Cloud Topics: Google's Threat Intelligence Group (GTIG) has a unique position, accessing both underground forum data and incident response information. How does this dual perspective enhance your ability to identify and attribute cybercriminal campaigns? Attributing cyberattacks with high confidence is important. Can you walk us through the process GTIG uses to connect an incident to specific threat actors, given the complexities of the threat landscape and the challenges of linking tools and actors? There is a difficulty of correlating publicly known tool names with the aliases used by threat actors in underground forums. How does GTIG overcome this challenge to track the evolution and usage of malware and other tools? Can you give a specific example of how this "decoding" process works? How does GTIG collaborate with other teams within Google, such as incident response or product security, to share threat intelligence and improve Google's overall security posture? How does this work make Google more secure? What does Google (and specifically GTIG) do differently than other organizations focused on collecting and analyzing threat-intelligence? Is there AI involved? Resources: “Cybercrime: A Multifaceted National Security Threat” report EP112 Threat Horizons - How Google Does Threat Intelligence EP175 Meet Crystal Lister: From Public Sector to Google Cloud Security and Threat Horizons EP178 Meet Brandon Wood: The Human Side of Threat Intelligence: From Bad IP to Trafficking Busts “Wild Swans: Three Daughters of China” book How Google Does It: Making threat detection high-quality, scalable, and modern How Google Does It: Finding, tracking, and fixing vulnerabilities “From Credit Cards to Crypto: The Evolution of Cybercrime” video…
C
Cloud Security Podcast by Google

1 EP210 Cloud Security Surprises: Real Stories, Real Lessons, Real "Oh No!" Moments 26:58
26:58
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi26:58
Guest: Or Brokman , Strategic Google Cloud Engineer, Security and Compliance, Google Cloud Topics: Can you tell us about one particular cloud consulting engagement that really sticks out in your memory? Maybe a time when you lifted the hood, so to speak, and were absolutely floored by what you found – good or bad! In your experience, what's that one thing – that common mistake – that just keeps popping up? That thing that makes you say 'Oh no, not this again!' 'Tools over process' mistake is one of the 'oldies.' What do you still think drives people to it, and how to fix it? If you could give just one piece of cloud security advice to every company out there, regardless of their size or industry, what would it be? Resources: Video ( YouTube ) “Threat Modeling: Designing for Security” by Adam Shostack EP16 Modern Data Security Approaches: Is Cloud More Secure? EP142 Cloud Security Podcast Ask Me Anything #AMA 2023 “For a successful cloud transformation, change your culture first” (OOT vs TOO blog) https://www.linkedin.com/in/stephrwong/ New Paper: “Autonomic Security Operations — 10X Transformation of the Security Operations Center” (2021)…
C
Cloud Security Podcast by Google

1 EP209 vCISO in the Cloud: Navigating the New Security Landscape (and Don’t Forget Resilience!) 29:06
29:06
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi29:06
Guests: Beth Cartier , former CISO, vCISO, founder of Initiative Security Guest host of the CISO mini-series: Marina Kaganovich , Executive Trust Lead, Office of the CISO @ Google Cloud Topics: How is that vCISO’ing going? What is special about vCISO and cloud? Is it easier or harder? AI, cyber, resilience - all are hot topics these days. In the context of cloud security, how are you seeing organizations realistically address these trends? Are they being managed effectively (finally?) or is security always playing catch up? Recent events reminded us that cybersecurity may sometimes interfere with resilience. How have you looked to build resilience into your security program? The topic is perhaps 30+ years old, but security needs to have a seat at the table, and often still doesn’t - why do you think this is the case? What approaches or tips have you found to work well in elevating security within organizations? Any tips for how cyber professionals can stay up to date to keep up with the current threat landscape vs the threats that are around the corner? Resources: EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) EP189 How Google Does Security Programs at Scale: CISO Insights EP129 How CISO Cloud Dreams and Realities Collide EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen! EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?…
C
Cloud Security Podcast by Google

1 EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) 31:19
31:19
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi31:19
Guest host: Marina Kaganovich , Executive Trust Lead, Office of the CISO @ Google Cloud Guest: John Rogers , CISO @ MSCI Topics: Can you briefly walk us through your CISO career path? What are some of the key (cloud or otherwise) trends that CISOs should be keeping an eye on? What is the time frame for them? What are the biggest cloud security challenges CISOs are facing today, and how are those evolving? Given the rapid change of pace in emerging tech, such as what we’ve seen in the last year or so with gen AI, how do you balance the need to address short-term or imminent issues vs those that are long-term or emergent risks? What advice do you have for how CISOs can communicate the importance of anticipating threats to their boards and executives? So, how to be a forward looking and strategic yet not veer into dreaming, paranoia and imaginary risks? How to be futuristic yet realistic? The CISO role as an official title is a relatively new one, what steps have you taken to build credibility and position yourself for having a seat at the table? Resources: ATT&CK Framework EP189 How Google Does Security Programs at Scale: CISO Insights EP129 How CISO Cloud Dreams and Realities Collide EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen! EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?…
C
Cloud Security Podcast by Google

1 EP207 Slaying the Ransomware Dragon: Can a Startup Succeed? 32:55
32:55
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi32:55
Guest: Bob Blakley , Co-founder and Chief Product Officer of Mimic Topics: Tell us about the ransomware problem - isn't this a bit of old news? Circa 2015, right? What makes ransomware a unique security problem? What's different about ransomware versus other kinds of malware? What do you make of the “RansomOps” take (aka “ransomware is not malware”)? Are there new ways to solve it? Is this really a problem that a startup is positioned to solve? Aren’t large infrastructure owners better positioned for this? In fact, why haven't existing solutions solved this? Is this really a symptom of a bigger problem? What is that problem? What made you personally want to get into this space, other than the potential upside of solving the problem? Resources: EP206 Paying the Price: Ransomware's Rising Stakes in the Cloud EP89 Can We Escape Ransomware by Migrating to the Cloud? EP45 VirusTotal Insights on Ransomware Business and Technology EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators EP7 No One Expects the Malware Inquisition Anderson Report (July 1972) “The Innovator Dilemma” book “Odyssey” book (yes, really) Crowdstrike External Technical Root Cause Analysis — Channel File 291 (yes, that one)…
C
Cloud Security Podcast by Google

1 EP206 Paying the Price: Ransomware's Rising Stakes in the Cloud 33:01
33:01
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi33:01
Guest: Allan Liska , CSIRT at Recorded Future, now part of Mastercard Topics: Ransomware has become a pervasive threat. Could you provide us with a brief overview of the current ransomware landscape? It's often said that ransomware is driven by pure profit. Can you remind us of the business model of ransomware gangs, including how they operate, their organizational structures, and their financial motivations? Ransomware gangs are becoming increasingly aggressive in their extortion tactics. Can you shed some light on these new tactics, such as data leaks, DDoS attacks, and threats to contact victims' customers or partners? What specific challenges and considerations arise when dealing with ransomware in cloud environments, and how can organizations adapt their security strategies to mitigate these risks? What are the key factors to consider when deciding whether or not to pay the ransom? What is the single most important piece of advice you would give to organizations looking to bolster their defenses against ransomware? Resources: Video ( LinkedIn , YouTube ) 2024 Data Breach Investigations Report EP89 Can We Escape Ransomware by Migrating to the Cloud? EP45 VirusTotal Insights on Ransomware Business and Technology EP29 Future of EDR: Is It Reason-able to Suggest XDR? EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators…
C
Cloud Security Podcast by Google

1 EP205 Cybersecurity Forecast 2025: Beyond the Hype and into the Reality 28:19
28:19
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi28:19
Guest: Andrew Kopcienski , Principal Intelligence Analyst, Google Threat Intelligence Group Questions: You have this new Cybersecurity Forecast 2025 report , what’s up with that? We are getting a bit annoyed about the fear-mongering on “oh, but attackers will use AI.” You are a threat analyst, realistically, how afraid are you of this? The report discusses the threat of compromised identities in hybrid environments (aka “no matter what you do, and where, you are hacked via AD”). What steps can organizations take to mitigate the risk of a single compromised identity leading to a significant security breach? Is this expected to continue? Is zero-day actually growing? The report seems to imply that, but aren’t “oh-days” getting more expensive every day? Many organizations still lag with detection, in your expertise, what approaches to detection actually work today? It is OK to say ”hire Managed Defense ”, BTW :-) We read the risk posed by the "Big Four" sections and they (to us) read like “hackers hack” and “APTs APT.” What is genuinely new and interesting here? Resources: Cybersecurity Forecast 2025 report Google Cloud Cybersecurity Forecast 2025 webinar EP147 Special: 2024 Security Forecast Report EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side EP153 Kevin Mandia on Cloud Breaches: New Threat Actors, Old Mistakes, and Lessons for All Staying a Step Ahead: Mitigating the DPRK IT Worker Threat…
C
Cloud Security Podcast by Google

1 EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators 30:32
30:32
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi30:32
Guest: Phil Venables , Vice President, Chief Information Security Officer (CISO) @ Google Cloud Topics Why is our industry suddenly obsessed with resilience? Is this ransomware’s doing? How did the PCAST report come to be? Can you share the backstory and how it was created? The PCAST report emphasizes the importance of leading indicators for security and resilience. How can organizations effectively shift their focus from lagging indicators to these leading indicators? The report also emphasizes the importance of "Cyber-Physical Modularity" - this sounds mysterious to us, and probably our listeners! What is it and how does this concept contribute to enhancing the resilience of critical infrastructure? The report advocates for regular and rigorous stress testing. How can organizations effectively implement such stress testing to identify vulnerabilities and improve their resilience? In your opinion, what are the most critical takeaways from our PCAST-related paper for organizations looking to improve their security and resilience posture today? What are some of the challenges organizations might face when implementing the PCAST recommendations, and how can they overcome these challenges? Do organizations get resilience benefits “for free” by using Google Cloud? Resources: 10 ways to make cyber-physical systems more resilient “Cyber-Physical Resilience and the Cloud: Putting the White House PCAST report into practice” report Megatrends drive cloud adoption—and improve security for all EP163 Cloud Security Megatrends: Myths, Realities, Contentious Debates and Of Course AI Advising The President On Cyber-Physical Resilience - Philip Venables (at PSW) EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side…
C
Cloud Security Podcast by Google

1 EP203 Cloud Shared Responsibility: Beyond the Blame Game with Rich Mogull 37:13
37:13
Daha Sonra Çal
Daha Sonra Çal
Listeler
Beğen
Beğenildi37:13
Guest: Rich Mogull , SVP of Cloud Security at Firemon and CEO at Securosis Topics: Let’s talk about cloud security shared responsibility. How to separate the blame? Is there a good framework for apportioning blame? You've introduced the Cloud Shared Irresponsibilities Model , stating cloud providers will be considered partially responsible for breaches even if due to customer misconfigurations. How do you see this impacting the relationship between cloud providers and their customers? Will it lead to more collaboration or more friction? We both know the Jay Heiser 2015 classic “cloud is secure, but you not using it securely.” In your view, what does “use cloud securely” mean for various organizations today? Here is a very painful question: how to decide what cloud security should be free with cloud and what security can be paid? You dealt with cloud security for a long time, what is your #1 lesson so far on how to make the cloud more secure or use the cloud more securely? What is the best way to learn how to cloud? What is this CloudSLAW thing? Resources: EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff The Cloud Shared Irresponsibilities Model 2002 Trustworthy computing memo Use Cloud Securely? What Does This Even Mean?! EP145 Cloud Security: Shared Responsibility, Shared Fate, Shared Faith? No Snow, No Flakes: Pondering Cloud Security Shared Responsibility, Again! Cloud Security Lab a Week (S.L.A.W) Megatrends drive cloud adoption—and improve security for all Shared fate main page Defining the Journey—the Four Cloud Adoption Patterns Celebrating 200 Episodes of Cloud Security Podcast by Google and Thanks for all the Listens!…
Player FM'e Hoş Geldiniz!
Player FM şu anda sizin için internetteki yüksek kalitedeki podcast'leri arıyor. En iyi podcast uygulaması ve Android, iPhone ve internet üzerinde çalışıyor. Aboneliklerinizi cihazlar arasında eş zamanlamak için üye olun.