Cloud Security Podcast

The Cloud Security Podcast team is headed to BSidesSF and RSA Conference! We will be recorded interviews LIVE at both events and have a bunch of fun things planned. If you are attending please do say hello or send Shilpi or Ashish a message :) Looking forward to seeing lots of wonderful people and having some great chats #bsidessf #rsa2024 #rsaconference

👨🏾✈️ As a CISO, what should be part of your Cloud Security Strategy? 🎙️ 🔑 Identity Access Management (IAM) Learnings - Transfer your IAM successes from one cloud to another and avoid past mistakes. - Understand that each cloud platform's IAM behaves differently—what works for one may not work for all. 🛠 Misconfiguration Management - Prioritize a proactive approach to configurations during your cloud setup. - Invest in skilled architects early to avoid costly misconfigurations and policy inconsistencies. 🌪 Building a Resilient Cloud Security Strategy - Find the best security engineers without being constrained by cloud-specific expertise. - Emphasize customization and policy synchronization across cloud platforms for optimal security. 📡 The Next Frontier: Effective Monitoring - Develop robust monitoring strategies to manage and secure your cloud assets continuously. - Understand the critical role of security operations in maintaining oversight and responding to incidents. We spoke to Vivek S. Menon, CISO at Digital Turbine about navigating a Multi Cloud Security Program, this was a great listen and we have linked the full episode in the comments below for you! #cloudsecurity #multicloudsecurity #ciso

🔒 Every Security Tool we onboard must have an ROI for the business! But how do we demonstrate this? We spoke to Loris Degioanni, CTO and Founder at Sysdig about the complexities of cloud-native security. If you are considering exploring runtime cloud security tools in 2024, this episode with Loris is a good listen as he draws on his experience on building open source Falco. Link for the full episode in the comments below #cloudnativesecurity #runtimesecurity #kubernetesecurity

How is #eBPF impacting Kubernetes Network Security? In this episode, recorded LIVE at Kubecon EU Paris 2024, Liz Rice, Chief Open Source Officer at Isovalent took us through the technical nuances of eBPF and its role in enabling dynamic, efficient network policies that go beyond traditional security measures. She also discusses Tetragon, the new subproject under #Cilium, designed to enhance runtime security with deeper forensic capabilities. A great conversation for anyone involved in Kubernetes workload management, offering a peek into the future of cloud-native technologies and the evolving landscape of network security. #cloudnativesecurity #kubernetessecurity

❓ What does it mean to be a CISO? A lot of folks entering the world of cybersecurity, often aspire to be a CISO but what does being a CISO truly mean? We had the pleasure to having Fredrick Lee, CISO at Reddit, Inc. on the podcast to share his thoughts on this! 🚀 Embrace risk as a pathway to innovation: Understand that avoiding all risks might prevent your business from capturing new opportunities. 🛡️ Shift from risk prevention to risk enablement: As you rise in leadership, focus on enabling calculated risks that drive business growth. 🤖 Practical use of technologies like Kubernetes: Evaluate technologies for their ability to manage risks effectively and unlock business and human value. Flee had some incredible insights to share and if you have ever wondered what being a CISO is like and you aspire to become one, this episode is a great listen. Full episode added in the comments below! #ciso #cloudsecurity #cisocareers

What do you need to know about when moving from on-prem to Google Cloud? In this episode Ashish Rajan is joined by ⛅️ Jorge Liauw Calo from Xebia, recorded live at KubeCon Paris. Jorge, a Google Cloud Practice Lead, shares his transition from on-prem to cloud environments and highlights essential security aspects within Google Cloud, including IAM, network security, and the use of Terraform for scaling security measures effectively. #cloudsecurity #googlecloudsecurity #terraform HashiCorp

🔒 Are you fully protected against container escapes in your cloud environment? 🌐 We spoke to Magno Logan about what Container Escape is and how to navigate it in your cloud environment! 🚀 Breaking Out of the Box: 📦 Containers are isolated environments—until they're not, breaking out can compromise your entire cloud infrastructure. 👾 With greater access comes greater risk: Attackers can exploit root privileges and what does that means for your nodes? 💻 From stealthy crypto miners to rogue containers, there sophisticated tactics being used that can undermine your cloud security. 🔑 Unrestricted access to instance metadata and IAM permissions can lead to disaster. Find out how to safeguard your critical assets. If you using containers in your environment then you definitely want to know about Container Escape and this episode is certainly worth a listen! #CloudSecurity #ContainerSecurity #cloudnativesecurity

How can we leverage AI for more secure and efficient code and how will it impact devsecops? Ashish spoke to Michael Hanley, CSO and SVP of Engineering at GitHub about the transformative impact of GitHub Copilot and AI on software development and security. Michael speaks about GitHub's internal use of Copilot for over three years and its role in enhancing developer satisfaction and productivity by removing mundane coding tasks. They speak about the broader implications for DevSecOps, the future of AI in coding, and strategic tips for integrating AI tools within organizations. #githubcopilot #aisecurity #securedevelopment #devsecops

We are going to see a lot more AI generated code! But should we trust it? We spoke to Joseph Katsioloudes from the GitHub Security Lab, AI in development processes posing new challenges and opportunities. 🚀 🤖 Can AI-generated code be trusted in production environments? 🔍 The necessity of rigorous code reviews—whether AI-generated or not. ✅ Best practices for ensuring your code is secure, emphasizing consistent security testing protocols. You can check out the full episode in the comments below and if this topic is of interest to you, be sure to catch our episode with GitHub CISO Michael Hanley airing tomorrow on all your favourite audio and video platforms #cloudsecurity #aisecurity #githubcopilot

🔒How do you maximise the ROI of your cloud security operations? 🚀 We spoke to Ariel Parnes, Co-Founder Mitiga about the essential metrics for evaluating the efficiency and effectiveness of security programs, especially in the dynamic realm of cloud security. 🕒 Time to Respond - Quick detection, investigation, and response times are crucial. - New regulations mandate timely breach reporting, increasing the need for speed to reduce costs and damage. 🛡️ Coverage Metrics - Utilize frameworks like MITRE ATT&CK to gauge the breadth of your threat detection. - Broad coverage ensures diverse threats are identified early, enhancing your security posture. Ariel spoke about how these metrics not only reflect but also amplify the ROI of your security investments, providing tangible benefits aligned with the latest industry standards and board expectations. 🎧 For a deeper dive and recommendations, listen to the full episode—link in comments! #CloudSecurity #InfoSec #incidentresponse