Cloud Security Podcast

🔗 What does bridging the gap between Security and Engineering truly look like? We spoke to Michael Hanley, who has a unique role in that he is the Chief Security Officer and the SVP of Engineering at GitHub and so we asked him, how do we bridge the gap between security and engineering. This episode with Michael is a great listen and we have linked the full episode for you in the comments below! #devsecops #ciso #cybersecurityleadership

What's the best way to navigate least privilege complexities in a multi cloud environment? And how is the role of identity management evolving? We spoke to Jeff Moncrief from Sonrai Security on why identity is the new network in the cloud-driven world. We speak about the challenges of implementing least privilege in cloud environments, the misconceptions surrounding identity roles, and the critical importance of segmenting access across public clouds just as rigorously as we did on-premises. #cloudsecurity #identitymanagement #cybersecurity

☁️❓ Did cloud change cybersecurity for CISOs? ⁉ "Cloud security didn't force us to do anything new; it made us realize what we should have been doing all along." 🌐🔒 - Fredrick Lee, CISO at Reddit, Inc. - A Reality Check: Traditional data centers, even those at major institutions like Bank of America, weren't as secure as they seemed. - Scaling Security: Cloud forced us to think at scale and consider every possible attack vector. 🛡️ - From Fear to Love: Flee shared an inspiring story from Twilio's early days, when cloud pioneers were learning to embrace AWS and turn fear into a powerful ally. - Provable Security: Cloud has enabled almost provable security through the transformation of infrastructure into code. 📜💻 - Accessibility for All: Cloud democratized cybersecurity, making it accessible to anyone with a free AWS tier, and paving the way for a new generation of security professionals. 🌍👩💻👨💻 This episode with Flee is a great listen if you are a current or aspiring cybersecurity leader or a CISO, you will definitely resonate with this one! Full episode linked in the comments below ⬇️ #ciso #cloudsecurity #cybersecurityleadership

🐝 ☸️ Why care about eBPF and Cilium? We spoke to Liz Rice, Chief Open Source Officer Isovalent about what is #ebpf and #cilium all about? 🐝 eBPF and the Kernel: eBPF empowers us to insert custom programs into the kernel, enabling advanced observation and manipulation of system behavior. 🐝 Networking Efficiency: Cilium optimizes networking operations, enhancing performance and scalability in cloud environments. 🐝 Security Innovations: eBPF and Cilium are changing security by providing deep visibility and control over network traffic and system processes If you are interested to learn more about eBPF and Cilium, Liz is a great SME on this and this interview with her is a great listen. We have linked the full episode in the comments below! #kubernetesecurity

🐝 Why is #ebpf gaining momentum in Cloud Native Security? We spoke to Loris Degioanni, CTO and Founder at Sysdig at #kubeconeu2024 about the world of eBPF and why is it secure? 💡 Why eBPF is secure: eBPF's validation process ensures safe execution by restricting potentially dangerous actions. 🔒 Enhanced safety measures: eBPF's design prevents arbitrary code execution, protecting your systems from crashes and data breaches. 🌐 Community adoption: Cybersecurity community is rapidly embracing eBPF as the go-to method for extending the Linux operating system. If eBPF is something that you are interested in then this is definitely a good episode for you to listen to. We have linked the full episode in the comments below! #kubernetesecurity #cloudnativesecurity

🔒💭 How can we handle incidents in the cloud as effectively as on-prem? 🌐🛡️ We spoke to Andrew Tabona, Head of Cyber Threat Management & Incident Response at a Fortune 500 about the dynamic and complex nature of cloud environments 🎯 Framework Familiarity: Whether it's SANS, PICERL or NIST, the foundational principles remain the same. However... 🔑 Adaptation is Key: - Enhanced Logging and Telemetry: Tools and data available in the cloud can transform how we approach incident detection and response. - Service Complexity: With new services launching frequently, keeping up requires robust architectural standards—yet flexibility remains crucial for developers. - 🌪 Rapid Response Capabilities: Microservices and Auto Scaling: Log management becomes a high-speed task, with crucial data points fluctuating within minutes. - 🕵️♂️ Forensic Challenges: Data Dispersion: Traditional forensic methods struggle to cope with the scattered nature of cloud architecture, necessitating new tools and techniques for effective analysis. If incident response is a something of interest to you, this is a great episode to listen to! #CloudSecurity #IncidentResponse #InfoSec

💡Can a CSPM help with Cloud Incident Response in 2024? 🚀 We spoke to Andrew Tabona, Head of Cyber Threat Management & Incident Response at a Fortune 500 about the common misconceptions about CSPM tools and their true capabilities in the dynamic cloud environment of 2024. 🔹 CSPM's Real Role: Primarily focuses on hygiene—cleaning up misconfigurations and policy violations. ✅ 🔹 Limitations: While CSPM is crucial, it doesn't excel at alerting or detecting real-time attacks. 🚨 🔹 Enhancing Incident Response: Explore building custom solutions with cloud-native tools or integrating specialized detection platforms. 🛠️ If you are looking at Cloud Incident Response in 2024, then this episode is a great listen. Full episode linked in the comments below! #CloudSecurity #IncidentResponse #CSPM #Cybersecurity2024

🔒 A question that a lot of folks are asking - How Will AI Transform Cloud Security and Development in 2024? 🔒 We spoke to Michael Hanley, CSO & SVP of Engineering at GitHub about the transformative potential of AI for enhancing security measures and optimizing developer productivity in the coming years. 🚀 Increased Productivity: How AI is streamlining code development processes. 🔐 Enhanced Security: Integrating AI tools like static analysis into the development phase to catch vulnerabilities early. 🔧 Reduced Technical Debt: AI's role in tackling longstanding security and quality issues. The year is 2024, and we are still perfecting the basics like system patching and two-factor authentication. But with AI, the concept of "shift left" in security is reaching a whole new level. It's no longer just about catching issues pre-production; it's about integrating security from the very start of code writing. 🛡️ If the role of AI in Cloud Security and Development is of interest to you and this is a great episode with Michael, we have linked the full episode in the comments below. #CISO #CloudSecurity #AIsecurity #DevSecOps

🤔Have you heard about the New York lawyer who submitted a fake case? We spoke to Matt McKeever, CTO of Cloud Engineering at LexisNexis about why such scenarios are improbable in well-structured systems. Matt spoke about the nuances of using your own Generative AI models in a tightly secured environment. The episode captures: 🛡️ The benefits of maintaining a closed-loop system for Generative AI models 🚫 Robust security measures that prevent unauthorized data manipulation 📑 The importance of prompt engineering to filter inputs before they interact with large language models 🗂️ Ensuring reliability by using well-vetted, proprietary content databases If you are considering using custom LLM in your cloud environment, you would find this episode to be valuable. We have linked the full episode in the comments below. #aisecurity #llmsecurity #cloudsecurity

The Cloud Security Podcast team is headed to BSidesSF and RSA Conference! We will be recorded interviews LIVE at both events and have a bunch of fun things planned. If you are attending please do say hello or send Shilpi or Ashish a message :) Looking forward to seeing lots of wonderful people and having some great chats #bsidessf #rsa2024 #rsaconference