Cloud Security Today
Matthew Chiodi
Subscribe
The Cloud Security Today podcast features expert commentary and personal stories on the “how” side of cloud security. This is not a news program but rather a podcast that focuses on the practical side of how to launch a cloud security program, how to implement DevSecOps as well as understanding the threats most impacting cloud today.
Available episodes
Newest first
Oldest first
Sep 21, 2023
SBOMs: Good but less than a silver bullet
*Episode Summary*
On today’s episode, Senior Advisor and Strategist at the Cybersecurity and Infrastructure Security Agency, Allan Friedman, joins Matt to discuss SBOMs. As Senior Advisor and Strategist at CISA, Allan coordinates the global cross-sector community efforts around software bill of materials (SBOM). He was previously the Director of Cybersecurity Initiatives at NTIA, leading pioneering work on vulnerability disclosure, SBOM, and other security topics.
Before joining the Federal government, Friedman spent over a decade as a noted information security and technology policy scholar at Harvard’s Computer Science Department, the Brookings Institution, and George Washington University’s Engineering School.
He is the co-author of the popular text Cybersecurity and Cyberwar: What Everyone Needs to Know, has a C.S. degree from Swarthmore College, and a Ph.D. from Harvard University.
Today, Allan talks about SBOMs and their adoption in non-security industries, Secure by design and secure by default tactics, and how to make software security second nature. What, exactly, is the SBOM? Hear about how SBOMs could’ve helped against significant attacks, the concept of antifragility, and why vulnerability disclosure programs are so important.
*Timestamp Segments*
· [02:27] Allan’s career path.
· [05:10] Allan’s day-to-day.
· [06:15] What has been most rewarding?
· [08:00] SBOMs in non-security startups.
· [10:50] Real-world examples of Secure by Design tactics.
· [17:30] Will software security ever seem obvious to us?
· [19:30] What is the SBOM, and will it solve all our problems?
· [23:41] Could an SBOM have helped against the SolarWinds attack?
· [27:52] Memory-safe programming languages.
· [30:16] Misconceptions around Secure by Design, Secure by Default.
· [32:00] The importance of vulnerability disclosure programs.
· [35:37] Antifragility in cybersecurity.
· [41:47] VEX.
· [44:29] How to get involved with CISA.
· [48:00] How does Allan stay sharp?
*Notable Quotes*
· “Sometimes, organizations need a good excuse to do the right thing.”
· “It is bananas that software that we use, and pay for, still delivers with it not just the occasional vulnerability, but very real risks that require massive investments from customers.”
· “When tech vendors make important logging information available for free, everyone wins.”
· “The SB in SBOM doesn’t stand for Silver Bullet.”
* *
*Relevant Links*
Email: sbom@cisa.dhs.gov
Website: www.cisa.gov
LinkedIn: Allan Friedman
*Resources:*
Open Source Security Podcast
Risky Business PodcastSecure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Aug 21, 2023
AppSec: Engineering, Attackers, and Defense
*Episode Summary*
In today’s episode, AppSec CTO at Palo Alto Networks, Daniel Krivelevich, joins Matt to talk about AppSec for the modern engineering ecosystem. Daniel is a Cybersecurity expert and problem solver with a proven track record from working with numerous enterprises across several different industries, with a focus on Application and Cloud Security. He has served in the Intelligence Corps of the IDF, 8200, as a Security Specialist at LivePerson, and as the Cloud & Application Security Lead at Sygnia. He is also the Co-Founder of Cider Security, which was acquired by Palo Alto Networks in December 2022.
Today, Daniel talks about how his views have been shaped by his experience on both sides of the equation, the rapid pace of software development, and the role of codification. Why is visibility such a vital part of mitigating threats? Hear about the changing role of security, the struggle with maintaining cybersecurity 101, and Daniel’s recommended sources to stay up to date.
*Timestamp Segments*
· [02:43] How Daniel’s experiences have shaped his AppSec views.
· [09:27] The software engineering paradigm shift.
· [12:24] The role of security.
· [16:42] Is it realistic for security to keep up with software development?
· [20:27] How the engineers’ freedom of choice impacts security.
· [26:14] The role of codification to reduce the attack surface.
· [30:21] Tools as targets.
· [34:47] How to mitigate threats of the increasingly complex ecosystems.
· [39:21] What’s next?
· [44:40] The struggle with cybersecurity 101.
· [47:03] How Daniel stays sharp.
*Notable Quotes*
· “The attacks that abuse the engineering ecosystem, they’re not theory anymore.”
· “The challenge is helping defenders focus on what matters.”
· “Attackers always choose the path of least resistance.”
· “Once you have that visibility, you are usually capable of significantly reducing your attack surface.”
· “It’s not the zero days that are what’s leading.”
*Relevant Links*
Website: www.paloaltonetworks.com.
LinkedIn: Daniel Krivelevich.
*Resources:*
AppSec for the Modern Engineering Ecosystem.Secure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Jul 21, 2023
Securing Democracy: DNC's Cyber Cop
On today’s episode, CSO at the Democratic National Committee, Steve Tran, joins Matt to talk about magic, AI, and cybersecurity. As the CSO for the DNC, Steve leads their IT, physical, and cybersecurity strategy. When not defending against dedicated adversaries, Steve can be found doing “off the cuffs” performances at the World-Famous Magic Castle in Hollywood.
Today, Steve talks about how he incorporates magic into cybersecurity, his transition from law enforcement to cybersecurity, and how to mitigate risk in a fast-moving environment. What are the potential risks of using generative AI? Hear about our susceptibility to mental malware, thinking strategically versus tactically to solve problems, and how Steve manages to stay sharp day-to-day.
*Timestamp Segments*
· [01:21] Steve, the magician.
· [05:14] Parallels between magic and cybersecurity.
· [07:21] Transitioning from law enforcement to cybersecurity.
· [16:26] Using magic to manage mental health.
· [21:25] The DNC.
· [22:19] Decentralization and security.
· [24:59] Getting buy-in.
· [27:42] Thinking strategically.
· [29:09] Mitigating risk in a fast-moving environment.
· [36:00] AI and cyberattacks.
· [43:25] Potential issues with AI.
· [50:46] How Steve stays sharp.
*Notable Quotes*
· “Mental health can really affect cybersecurity professionals.”
· “Business isn’t meant to be just transactional.”
· “One of the biggest barriers to why people don’t buy into it at first is because they don’t understand it.”
· “Security issues don’t care if you don’t have a budget or don’t have a team.”
· “Once you get people to feel a certain way, you can’t undo that.”
· “There’s no better way to learn than to have to teach material yourself.”Secure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Jun 21, 2023
Open Source Security: A Deep Dive
*Episode Summary*
On this episode, the Co-Founder and CEO of Endor Labs, Varun Badhwar, joins Matt to talk about software supply chain security. Varun has a proven track record of building and leading enterprise security companies across Product Strategy, Marketing, Technical Sales, and Customer Success functions. He serves as a Member of the Forbes Technology Council, a Board Member of Cowbell, a Board Advisor of ArmorCode, and the former Founder and CEO of RedLock.
Today, Varun talks about open source risks, how to identify and mitigate risks, and how to incentivize the use of security tools. Where can organizations start? Hear about SBOMs, security in the Cloud, and software security best practices.
*Timestamp Segments*
· [01:42] A bit about Varun.
· [04:48] Identifying and mitigating risk.
· [10:32] Where should organizations start?
· [14:42] The SBOM.
· [19:51] Industry standards and best practices.
· [22:26] Cloud security.
· [25:50] Endor Labs.
· [29:52] Incentivizing using security tools.
*Notable Quotes*
· “Select, secure, maintain, comply.”
· “The first thing that drives a lot of security shifts is compliance.”
*Relevant Links*
Website: www.endorlabs.com
LinkedIn: Varun BadhwarSecure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
May 21, 2023
Accelerating security maturity
*Episode Summary*
On this episode, AWS Security Practice Manager, Chad Lorenc, joins Matt to talk about Cloud Security. Chad has spent over 20 years building and implementing security programs for numerous organizations, ranging from global Fortune 500 infrastructure teams to billion-dollar financial institutions. He has previously served as Senior Infrastructure Security Architect at Keysight Technologies, President of Montana Chapter, and Information Security and Risk Management Infrastructure Architect at Agilent Technologies.
Today, Chad talks about the roadmap to security maturity, security best practices, and benchmarking assessments. Why doesn’t AWS necessarily hire people with Cloud skills? Hear about The Five Pillars, when Cloud security goes wrong, CISO reporting Cloud security, and Chad’s formula for personal growth.
*Timestamp Segments*
· [01:24] A bit about Chad.
· [03:13] Chad’s role at AWS.
· [04:03] Transitioning to AWS.
· [08:30] AWS doesn’t hire for Cloud skills.
· [10:41] Where to start.
· [13:54] Assessment benchmarking.
· [15:09] Getting to security maturity.
· [19:17] The Five Pillars.
· [24:21] Cloud security gone wrong.
· [32:14] The Cloud Center of Excellence.
· [35:15] Reporting Cloud security maturity.
· [40:54] Chad’s formula for personal growth.
· [44:50] Chad’s words of wisdom.
*Notable Quotes*
· “There’s no algorithm for compressing security experience.”
· “Figuring out how to integrate Cloud into your operational processes and technology is key.”
· “The key to growing fast is to prioritize ruthlessly.”
*Relevant Links*
Website: aws.amazon.com
*Resources:*
awsfundamentals.comSecure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Apr 21, 2023
Cloud Native Security: A Year in Review
On this episode, the Chief Security Officer of Cloud at Palo Alto Networks, Bob West, joins Matt to discuss Palo Alto Network's latest State of Cloud Native Security Report. Bob joined Palo Alto Networks after more than 20 years in leadership roles with banks, product companies, and professional services organizations. Before joining Palo Alto Networks, Bob served as managing partner at West Strategy Group, managing director in Deloitte’s cyber risk services practice, managing director for CISO for York Risk Services, Chief Trust Officer at CipherCloud, CEO at Echelon One, Chief Information Security Officer (CISO) at Fifth Third Bank, and Information Security Officer at Bank One.
Today, Bob talks about the latest installment of the State of Cloud Native Security Report, the severe shortcomings in Cloud Security, and the elevated cost of Cloud Security. Why is it essential to think about security upfront? Hear about the daily mindset shift required to deploy quality code, minimizing complexity to maximize efficiency, and the significant delay in threat management.
*Timestamp Segments*
· [01:46] Bob’s career-changing experiences.
· [04:17] Bob’s advice.
· [11:10] The 10,000-ft view.
· [16:23] The elevated costs of Cloud security.
· [22:36] Increased deployment frequency.
· [24:54] How do security teams keep up?
· [30:44] Security tooling in the Cloud.
· [35:46] Holistic Cloud security.
· [41:18] There will always be issues.
*Notable Quotes*
· “Be nice to your vendors.” - Bob
· “You never know who’s going to be able to help you out at any point.” - Bob
· “You’ve got to build bridges before you need them.” - Matt
· “Common sense isn’t necessarily common practice.” - Bob
*Relevant Links*
Website: www.paloaltonetworks.com
LinkedIn: Bob West
*Resources:*
Out of the CrisisSecure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Mar 21, 2023
Book review: CISO Evolution
On this episode, the Founder of CISO Evolution LLC, Matthew Sharp, joins Matt to talk about his book, CISO Evolution. Prior to founding CISO Evolution LLC, Matt served as a strategic advisor to CISOs of Fortune 500 and global institutions. He holds a Bachelor of Science (BS) in Electrical and Computer Engineering from the University of Colorado and a Master of Business Administration (MBA) from Colorado State University. Matt is a co-author of "The CISO Evolution: Business Knowledge for Cybersecurity Executives."
Today, Matthew talks about his 2012 sabbatical, walking the Camino de Santiago, and the CISO Evolution book. Why does process matter more than analysis? Hear about value creation, business negotiations, and Matthew’s formula for personal growth.
*Timestamp Segments*
· [02:06] A bit about Matthew.
· [04:30] Matthew’s sabbatical & the Camino de Santiago.
· [09:21] What prompted the book?
· [12:23] Why does process matter more than analysis?
· [19:08] Did Matthew’s MBA lead him down this path?
· [24:22] Value creation.
· [27:40] Standard metrics.
· [31:23] Why is it important for a CISO to know terms?
· [33:32] Negotiations and decision-making.
· [37:19] What’s Matthew’s formula for personal growth?
· [41:12] Matthew’s words of wisdom.
*Notable Quotes*
· “If you want to be in the room where it happens, then you have to be equipped to participate in the conversation.”
· “Ask the questions that go unasked.”
· “Don’t be afraid to go and look like an idiot in front of another business stakeholder.”Secure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Feb 21, 2023
Unraveling unmanageable apps
On this episode, co-founder and CEO of Cerby, Belsasar Lepe, joins Matt to talk about unmanageable applications (apps that don't support critical security standards like SSO and SCIM). Belsasar was previously the Head of Product at Impira, where he led the company's product life cycle, helping drive a 4x increase in revenue. Before his role at Impira, Bel was co-founder and CTO at Ooyala, where he led a global product, design, and engineering team of 300+ Ooyalans spanning five countries and seven offices. Ooyala achieved two successful exits totaling over $440M.
Belsasar talks about unmanageable applications, Shadow IT, and why password managers should be considered legacy tech.
*Timestamp Segments*
· [02:14] A bit about Belsasar.
· [04:57] Unmanageable Applications.
· [07:07] Shadow IT.
· [11:04] Quantifying the risk.
· [14:50] How to identify Unmanageable Apps.
· [17:46] Using different tools.
· [21:03] Where do password managers fall in?
· [22:53] Is passwordless the future?
· [25:29] How Cerby solves the problem.
· [27:11] A Cerby success story.
· [30:48] The future of the market.
· [32:35] Migration to Cloud.
· [35:03] How Belsasar stays fresh.
*Notable Quotes*
· “The first task is understanding the size of the problem.”
· “The initial point of entry is often an unmanageable application.”
· “More businesses will rely on end users for their security.”
Cerby's website
Secure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Jan 21, 2023
SEC-retly Telling All: The New Cyber-Disclosure Rules
*Episode Summary*
On this episode, Matt speaks with Senior Executive, Board Director, and leader in Cybersecurity, risk management, and regulatory compliance, Chris Hetner about cybersecurity and the newly-proposed SEC cybersecurity rules. With over 25 years of experience in the cybersecurity space, Chris has served in roles including as Senior Cybersecurity Advisor to the Chairman at the SEC, Managing Director of Information Security Operations at GE Capital, and SVP Information Security at Citi.
Today, Chris talks about understanding the proposed cybersecurity rules, defining materiality, and the importance of focusing on cyber-resilience. Where does the Cloud come into it? Hear about the cost of cyberattacks, the core risk exposures, and Chris’s formula to personal growth.
*Timestamp Segments*
· [02:47] Chris’s proudest moments.
· [10:00] The new proposed rules.
· [14:26] Defining materiality.
· [23:56] Bridging the language gap.
· [32:14] Focusing on cyber-resilience.
· [35:36] Cybersecurity expertise on the board.
· [41:27] The cloud.
· [45:32] The formula to personal growth.
*Notable Quotes*
· “Ransomware extortion is relatively insignificant relative to the overall cost of the event.”
· “You can’t outsource the risk.”
· “Realize that you’re not always the smartest person in the room.”
· “We don’t know it all, and we never will.”Secure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Dec 21, 2022
Cloud Threat Report Vol 6
This episode of the Cloud Security Today podcast welcomes back favorite special guests Jay Chen and Nathaniel “Q” Quist to unpack the latest Cloud Threat Report. Join host Matt Chiodi as he shares insights from the report and analyzes the current state of cloud security.
Beginning with an in-depth look at Identity and Access Management (IAM) in cloud security, the guests talk about the latest changes in cloud security. They discuss the report’s findings on permissions and what cloud systems providers are currently doing (or not doing) to help keep cloud data secure. At the end of the episode, Jay and Q give tips on how to stay up-to-date on developments in the cloud security landscape and reveal the next projects that they’re working on.
If you enjoyed this episode, you can show your support for the podcast by rating and reviewing it and by subscribing to Cloud Security Today wherever you listen to podcasts.
Show Notes/Timestamps
[2:11] Matt welcomes repeat guests Jay and Q onto the show
[3:36] So, what’s changed for Identity and Access Management over the last year?
[8:05] Jay lays out what makes good cloud governance so difficult
[11:50] Complicating factors in cloud security
[14:22] What does the research show about permissions and over permissions on cloud systems?
[17:28] “When you can’t figure out what to do, you add more permissions:” How permissions multiply
[20:19] Are cloud service providers helping or hindering cloud security?
[24:03] Debating the Infrastructure as Code framework
[28:13] Q breaks down the Cloud Threat Actor Index
[31:32] Q’s top five bad actors on the cloud security landscape
[35:11] Jay gives his recommendations for IAM
[39:55] How you can stay up-to-date on the latest developments in cloud security
[42:10] The next projects that Jay and Q are working on
Links
Check out this episode’s sponsor, Prisma Cloud
Unit 42 reports
IAM-Deescalate Tool
Cloud Sec ListSecure applications from code to cloud.
Prisma Cloud, the most complete cloud-native application protection platform (CNAPP).
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
playlist_add
Nov 21, 2022
Pockets of Innovation
*Pockets of Innovation with John Chavanne*
*Episode Summary*
On this episode, Solutions Architect at Palo Alto Networks, John Chavanne, joins Matt to talk about his career of innovation. John’s career spans over 20 years at HSBC before transitioning into DevOps and Cloud Solutions at Palo Alto Networks.
Today, John talks about his career arc, transitioning to cloud, and the value of communities of practice groups. Where should organizations start with deploying a CNAP? Hear about the challenges with deploying cloud platforms, and John’s greatest accomplishments.
*Timestamp Segments*
· [01:30] About John.
· [02:54] John’s career.
· [05:47] What is something that cloud makes easier?
· [07:09] Transitioning from network to DevOps and Cloud.
· [10:15] Starting the move to cloud at HSBC.
· [13:15] Cloud communities of practice.
· [18:47] Sharing code.
· [21:27] John’s biggest accomplishment.
· [23:23] Prisma Cloud.
· [26:25] Organizational challenges with dep…
playlist_add
Oct 21, 2022
What Serverless Can Do For You
*What Serverless Can Do For You? With Mark Gould*
*Episode Summary*
On this episode, Cloud Security Engineer at Manhattan Associates, Mark Gould, joins Matt to talk about serverless computing. Mark is a Cybersecurity specialist, with a focus on the Google Cloud Platform, and is a Certified Google Architect.
Today, Mark talks about serverless computing, the security risk to consider, and working with DevOps teams. What are the top three metrics to start with for automation and security? Hear about cloud automation, Mark’s NSG alerting system, and his greatest accomplishments in recent years.
*Timestamp Segments*
· [01:22] About Mark.
· [02:49] About Manhattan Associates.
· [04:46] How does cloud fit in?
· [06:16] Automation in the cloud.
· [09:03] Modernization at Manhattan Associates.
· [10:18] Serverless computing.
· [14:39] Security risks with using serverless functions.
· [17:58] Mark’s NSG alerting system.
· [21:27] Three metrics for automation and securit…
playlist_add
Sep 21, 2022
Book Review: Startup Secure
*Book Review: Startup Secure with Chris Castaldo*
*Episode Summary*
On this episode, CISO at Crossbeam and Author of Startup Secure: Baking Cybersecurity into your Company from Founding to Exit, Chris Castaldo, joins Matt to talk about startups and security. Chris is an industry-wide recognized CISO, having over 20 years of experience in cybersecurity.
Today, Chris talks about his book, Startup Secure, his move to startups from the public sector, and the different startup development phases. What should startups focus on during the different development phases? Hear about security trust centers, the top startup security sins, and get Chris’s formula for personal growth.
*Timestamp Segments*
· [02:03] What prompted Chris to write Startup Secure?
· [04:57] What has changed during the writing process?
· [06:47] Critical decisions throughout Chris’s career.
· [11:17] Moving from public sector to startups.
· [15:39] Startup development phases.
· [20:16] When certificatio…
playlist_add
Aug 22, 2022
The Software Factory
*S2E8 - The Software Factory with Chris Hughes*
*Episode Summary*
On this episode, CISO and Co-Founder of Aquia, Chris Hughes, joins Matt to talk about building security in the cloud using automation and compliance. Chris’s career spans over 20 years in the IT/Cybersecurity industry, as well as in active service in the US Military.
Chris talks about licensing and certifications, Cloud innovation, and achieving continuous ATO. How are software factories created and operationalized? Hear about the people side of the business, effectively building a community, and get Chris’s formula for personal growth.
*Timestamp Segments*
· [01:19] Chris’s 28 licenses and certifications.
· [02:44] The value of certifications.
· [05:08] Chris’s Air Force experience.
· [06:25] About Aquia.
· [07:46] DoD vs the federal civilian space.
· [09:01] BatCave.
· [10:04] Federal DoD compliance.
· [12:55] How do agencies achieve Continuous ATO in the cloud?
· [16:04] Software Factorie…
playlist_add
Jul 21, 2022
Zero trust with no FUD
In today’s episode, the Creator of Zero Trust, John Kindervag, joins Matt on the show to discuss implementing Zero Trust in your organization. While at Forrester Research in 2010, John developed Zero Trust, promising adequate and effective protection of an organization’s most valuable assets.
Today, John talks about the driving force behind Zero Trust, the concept of the Protect Surface, and Kipling Method Policies. Why is trust a vulnerability? Hear about Zero Trust, Shadow IT, and get John’s recommended resources.
*Timestamp Segments*
· [02:20] About John.
· [05:29] How does John define Zero Trust?
· [07:45] Why is trust a vulnerability?
· [09:56] The Protect Surface.
· [12:32] Kipling Method Policies.
· [17:22] The roadmap to Zero Trust at scale.
· [22:56] It’s the inspection that matters.
· [28:26] Zero Trust in the Cloud.
· [31:33] Shadow IT.
· [38:54] Tracking specific metrics.
· [40:58] John’s resource recommendations.
*Notable Quote*
"We can…
playlist_add
Jun 27, 2022
Matt joins a startup
This episode of the Cloud Security Today podcast is a little different from the others because this time host Matthew Chiodi gives the interviewer’s seat over to Yousuf Khan and they talk about an exciting new development in Matt’s career.
Matt announces a big career move and talks about how he’s hoping to fix some of the biggest problems in SaaS security today. He tells Yousuf about his new role and the fresh approach that his new company is bringing to the field. At the end of the episode, they discuss working in a start-up environment and give advice to anyone considering working in a start-up.
If you enjoyed this episode, subscribe, or follow Cloud Security Today wherever you get your podcasts.
*Timestamps*
[0:28] Matt introduces the topic for today’s episode
[1:50] Exciting news from Matt about his latest career move
[5:10] Matt explains one of the biggest challenges in app security today
[7:25] How have we managed app security up to now?
[9:20] So how does Cerby w…
playlist_add
Jun 21, 2022
MITRE + Cloud
As the world of cloud security continues to progress at high speed, new challenges and threats arise and morph on a constant basis. The MITRE Corporation is a body tasked by the US government with solving some of the largest threats in cybersecurity and beyond, and we are very lucky to welcome Tracy Bannon to the podcast today, who is the Senior Principal and Software Architect & DevOps Advisor at MITRE. Tracy opens up about her career journey leading up to her current position, what drew her into the work at MITRE, and how the simplicity of the solutions-focused mission has embedded her loyalty and passion within the organization. The conversation also goes some way into exploring the potential and limitations of zero trust, and what it actually means to make progress towards safer environments. Along the way, our guest makes some interesting and quite unique arguments for why words matter, and why change is healthier through a philosophy centered on building. So to catch it all in th…
playlist_add
May 21, 2022
Building security natively
Originally recorded in September of 2021...today’s guest is Justin Berman, the Vice President of Infrastructure and IT and the CISO at Thirty Madison. Thirty Madison is aiming to be a platform that everyone can use to deal with their chronic healthcare needs. Justin’s main focus is on building out the teams that enable scaling. With his development background, Justin has some unique ideas when it comes to cloud security, which makes for a fascinating interview. You’ll walk away from this episode with a new perspective on how to build security into products from the start and a better understanding of how to transition smoothly from on-prem to the cloud.
*Tweetables
*“I see security as an engineering problem. What I mean by that is not that there aren't things that you solve with process, or with policy, or training, but rather that in as many places as possible if you want to have a scaled effect within security, you need to write code to solve a problem.” — @justinmberman…
playlist_add
Apr 18, 2022
What Is Threat Intelligence?
In this episode (originally recorded in November of 2021) we speak with Palo Alto Networks, VP of Threat Intel, Ryan Olson. Ryan helps define what threat intelligence actually is and how to get started building a program. He aptly reminds us that producing threat intel for the sake of threat intel is a waste of time. More importantly you first have to ask yourself, “Who’s going to be using this information?”.
*Tweetables*
“Producing threat intel for the sake of threat intel is a waste of time. What you should be doing is thinking ‘Who’s going to take the information that I have produced and use that to make a better decision?’ Because that's the goal of threat intelligence, to help a system, or a person, or a team, or a company make better decisions that will help secure them better.” — Ryan Olson [0:04:24]
“If I could give people one recommendation, if you can get access to your SSL traffic so that you can decrypt it and you can inspect it, you will have a much…
playlist_add
Mar 21, 2022
Compliant Unicorns
Nearly all companies that have started in the last few years have been cloud-native from the very start. Someone who has experienced this is today’s guest Nate Lee. Nate is the Chief Information Security Officer for Tradeshift, a cloud-based business networking platform for supply chain payments, marketplaces, and applications. In this episode, Nate joins us to talk about the company’s journey, its success, and what he has learned here over the past seven years. Nate explains how Tradeshift’s vision is to digitize and connect everything that happens between a buyer and a seller anywhere in the world, and how being cloud-native from the start has supported this mission. We discuss how you can leverage automation and DevSecOps to scale on some very difficult items like ISO 27000 among other certifications. You will also hear how security has been the key differentiator that led to Tradeshift’s success, how the strategic focus of Tradeshift’s security program has shifted over ti…
playlist_add
Feb 14, 2022
Fed Clouds
In a world where cyber-attacks are ever-changing, cybersecurity has to adapt accordingly. Joining us today to delve into the world of cloud security for federal agencies is Sandeep Shilawat, Vice President of Cloud and Edge Computing at ManTech. Sandeep has extensive experience in both Commercial and Federal technology markets. We’ll get to hear his predictions on where the cloud world is heading, as well as what the Federal Authority to Operate (ATO) process will look like in the future. We learn the benefits of cloud compliance standards, as well as how FedRAMP is leveling the playing field in federal cloud computing. We also touch on the role of 5G in cloud computing, and why its presence will disrupt going forward. Join us as we pick Sandeep’s brain for some insights into the present and future of federal cybersecurity.
*Tweetables
*“Visibility has become [the] single biggest challenge and nobody's dealing with cloud management in a multi-cloud perspective from cradle to gra…
playlist_add
Jan 17, 2022
Cloud Native Pharma
The pharmaceutical industry has a reputation for being cautious when it comes to adopting new technologies. However, in this episode, you’ll hear from the CISO at Takeda Pharmaceuticals, Mike Towers, that for Takeda cloud has been a game-changer (albeit not without some challenges). As we like to do, we’ll start by diving into Mike’s background and then pivot to understand where Takeda is today in their cloud journey and where they are going over the next 24 months.
Get your pen ready because Mike is going to drop a massive amount of knowledge in a short period of time.
*Tweetables:*
“One of the things that's the toughest in the biopharmaceutical industry is focus because it's really easy to get tempted to try to solve a lot of different problems.” — @MichaelATowers [0:02:47]
“We’ll be exclusively cloud, within probably, I would* say, 15 months from now.” — **@MichaelATowers** [0:17:51]*
*Links Mentioned in Today’s Episode:*
*Prisma Cloud*
*Mike Towers on T…
playlist_add
Dec 15, 2021
Supply Chain Security
Despite the media coverage afforded to the SolarWinds and Kaseya breaches, Palo Alto Networks, Unit 42 threat research indicates supply chain security in the cloud continues its growth as an emerging threat. Much remains misunderstood about both the nature of these attacks and the most effective means of defending against them. To better understand how supply chain attacks occur in the cloud, Unit 42 researchers analyzed data from a variety of public data sources around the world and, at the request of a large SaaS provider, executed a red team exercise against their software development environment. As you'll hear in the podcast, overall, the findings indicate that many organizations may still be lulled into a false sense of supply chain security in the cloud. Case in point: Even with limited access to the customer’s development environment, *it took a single Unit 42 researcher only three days to discover several critical software development flaws that could have exposed the custom…
playlist_add
Nov 10, 2021
Cloud Immigration
The journey toward the cloud is filled with challenges, but the benefits it brings make the struggle worthwhile. Today we talk about all things cloud adoption with Rob Brown, CTO at the US Citizenship and Immigration Services Group. We jump in with some introductory comments about who the USCIS are and what they do, with Rob giving listeners an idea of his role within the organization. We hear about the massive move toward digitization at USCIS and some of the biggest challenges the organization is facing as far as cloud adoption. From there, our conversation touches on the benefits of a multi-cloud approach, how USCIS is implementing Zero Trust with regards to cloud security, and how microsegmentation fits into all of this. Tuning in, listeners will also learn about the metrics Rob uses to assess the process of cloud adoption at USCIS, how the shift to the cloud has helped address the issue of siloing, and the benefits of implementing a unified pipeline grounded by standardization. We…
playlist_add
Oct 18, 2021
Innovating at the Speed of Relevance
When thinking of innovation, the first things that usually come to mind are tech startups. It’s not often you think of examples from the US Government or, more specifically, the Department of Defense. Our guest today has unprecedented insight, not only into what it takes to build a startup but how to create a startup-like culture in massive organizations like the US Department of Defense.
Nic Chaillan, has had tremendous success as an entrepreneur and, in 2016, decided to pursue public service when he took a job with the US government. Over the past 20 years, Nic has built hundreds of products that were sold to dozens of Fortune 500 companies. After taking a break from entrepreneurship, Nicolas served as the Chief Software Officer for the US Air Force and Space Force and introduced game-changing innovations to the government’s software operations.
In our conversation with Nic, we discuss agile practices and how he used DevSecOps to elevate the Department of Defense’s software s…
playlist_add
Sep 21, 2021
What (actually) Works In Cloud Security
Some of the most pertinent issues in cloud security are also very foundational. Questions like where to start, what works, and also what doesn’t work, can leave teams feeling frustrated and at a loss over how to proceed. Here to help us unpack these important questions is Jonathan Villa, the Cloud Security Practice director at GuidePoint Security.
Jonathan’s career wasn’t always in security, he has spent time as an application developer, and as a pentester. All of this led him to build solutions in the cloud over a decade ago which organically transitioned into cloud security. In our conversation with Jonathan, we discuss what he learned about cloud security throughout his career, what he has found to be effective, both in terms of technology and managing teams. We explore important issues like how security has struggled with automation and how to address it. Later we address the challenges facing talent development in security and how to address them, including having leadershi…
playlist_add
Aug 10, 2021
Putting the Sec in DevOps
Today’s guest is Guy Eisenkot and he joins us to talk about how culture is a critical aspect of shift-left security and DevOps. Guy is the Co-Founder of Bridgecrew, a tool that solves the talent shortage gap for building secure infrastructure in the public cloud. Our conversation begins with Guy giving some insight about his path into development and security, and he details his training in the Israeli military and subsequent experience building security tools for the civil market. In today’s discussion, Guy gets into how the security responsibilities of platform and infrastructure teams have changed as well as what security teams are missing when it comes to DevOps security. He shares his insights about how security and DevOps teams have been able to synchronize and also gets into some of the biggest pitfalls in DevOps as far as cybersecurity best practices. We explore how infrastructure as code could be the driver of two paths, one leading to a dangerous amount of freedom, and th…
playlist_add
Jul 13, 2021
Keeping Governments Secure in the Cloud
Cloud security is essential for any business but particularly for government agencies. On today’s episode, we speak with an expert in the field, Ravi Raghava, who is Chief Cloud Strategist at General Dynamics Information Technology (GDIT). Ravi speaks about his personal experience with dozens of cloud deployments for civil agencies and shares best practices.
*Acronyms*
* ATO = Authority to Operate
* POAM = Plan of Action and Milestones
* CDM = Continuous Diagnostics and Mitigation
* OCM = Organizational Change Management
*Tweetables:*
“Over the next few years, we will see a lot of traction and we will see accelerated workload migration to the cloud. It's not just one cloud but multiple clouds, and multi-cloud is becoming the new norm.” — Ravi Raghava [0:04:55]
“We are very strong advocates of OCM, and we work with our government customers to have a well thought-through strategy, providing the right skills, the right training, right medium of training to people.…
playlist_add
Jun 14, 2021
How COVID-19 Impacted Cloud Security
In this episode, Nathanial Quist, also known as ‘Q’ returns along with Dr. Jay Chen, both of whom listeners might recognize from our inaugural episode where we discussed how common identity misconfigurations can undermine cloud security. Both Jay and Q are threat researchers with Palo Alto Networks Unit 42. Unit 42 is the global threat intelligence team at Palo Alto Networks and a recognized authority on cyberthreats, frequently sought out by enterprises and government agencies around the world.
In our conversation, they discuss what they found in their latest Cloud Threat Report examining the impact of the COVID-19 pandemic. We explore how the tremendous increase in remote work has affected cloud security and why Jay is more concerned over the number of mistakes that people are making, rather than the type of mistakes. Tuning in you’ll hear what organizations can do to curtail the recent rise in security incidents and some interesting observations that Q and Jay learned from th…
playlist_add
May 10, 2021
How to Operationalize Cloud Security
Keeping it simple is Brett’s mantra, and it has led to a great amount of success for him and the company he works for. As a security leader at Zoetis, the world’s largest animal healthcare company, Brett has managed to get ahead of the business in terms of adopting cloud securely. Although it may sound boring, standardizing security processes was a key element in the journey to automation for the Zoetis SOC.
In today’s episode, Brett also talks about how he ended up in the world of cybersecurity after majoring in ecommerce, the different facets that make up his current role at Zoetis, as well as some of the tools that are extremely useful to Brett and his team. Brett also opines on how automation has led to a reduction in talent-drain on his team. We also briefly delve into the SolarWinds hack and how this changed the way Brett thinks and approaches supply chain security.
Key Points From This Episode:
* Getting ahead of the business, build it before they come!
* Standardiz…
playlist_add
Apr 12, 2021
Did You Know You Have a SaaS Problem?
While most companies have significantly increased their investments in SaaS, they have not updated their security controls and processes to ward off threats posed by this medium. Leaving SaaS security to Cloud Access Security Brokers (CASB) is not sufficient. The security controls need to be placed around the data, APIs, and applications that are running inside a cloud environment, not outside its perimeter. This is the kind of security that AppOmni provides and today we have its CEO, Brendan O'Connor on the show to dive deeper into the subject of SaaS security.
We begin with Brendan’s journey into IT and security and hear a bit more about what makes him tick. From there, we dive into the subject of security in the cloud as it pertains to SaaS specifically. Brendan does a great job of explaining why SaaS platforms are subject to so many misconfigurations and why these are not being recognized by security teams. He gets into how the cloud infrastructure is set up and uses a few brill…
playlist_add
Mar 10, 2021
How Common Identity Misconfigurations Can Undermine Cloud Security
Welcome to a brand new cloud security podcast, Cloud Security Today. Instead of focusing on the latest news, we’re exploring a different take on cloud security where we dig deeper into its eclectic “how-to” side. On Cloud Security Today, we are going to talk with experts from all over the community so you can do cloud security better. Today’s experts are Nathaniel Quist (Q) and Jay Chen, and they will be talking about Unit 42’s latest cloud threat research. First up Q and J, as we call them, introduce listeners to their professional histories before telling us how they choose their research projects. We then talk to Q and Jay about findings from their latest report on identity and access management. Together, they explain some of the common vulnerabilities that come with identity and access management, like misconfigured roles. Toward the end of the episode, we talk to Q about cryptojacking, as he explains the nuances to mining coins maliciously, the various teams behind the…
playlist_add