Guest:
Topics:
Resources:
Guest:
Royal Hansen, CISO, Alphabet
Topics:
What were you thinking before you took that “Google CISO” job?
Google's infrastructure is vast and complex, yet also modern. How does this influence the design and implementation of your security programs compared to other organizations?
Are there any specific challenges or advantages that arise from operating at such a massive scale?
What has been most surprising about Google’s internal security culture that you wish you could export to the world at large?
What have you learned about scaling teams in the Google context?
How do you design effective metrics for your teams and programs?
So, yes, AI. Every organization is trying to weigh the risks and benefits of generative AI–do you have advice for the world at large based on how we’ve done this here?
Resources:
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP20 Security Operations, Reliability, and Securing Google with Heather Adkins
EP91 “Hacking Google”, Op Aurora and Insider Threat at Google
“Delivering Security at Scale: From Artisanal to Industrial”
EP185 SAIF-powered Collaboration to Secure AI: CoSAI and Why It Matters to You
Guest:
Dor Fledel, Founder and CEO of Spera Security, now Sr Director of Product Management at Okta
Topics:
We say “identity is the new perimeter,” but I think there’s a lof of nuance to it. Why and how does it matter specifically in cloud and SaaS security?
How do you do IAM right in the cloud?
Help us with the acronym soup - ITDR, CIEM also ISPM (ITSPM?), why are new products needed?
What were the most important challenges you found users were struggling with when it comes to identity management?
What advice do you have for organizations with considerable identity management debt? How should they start paying that down and get to a better place? Also: what is “identity management debt”?
Can you answer this from both a technical and organizational change management perspective?
It’s one thing to monitor how User identities, Service accounts and API keys are used, it’s another to monitor how they’re set up. When you were designing your startup, how did you pick which side of that coin to focus on first?
What’s your advice for other founders thinking about the journey from zero to 1 and the journey from independent to acquisition?
Resources:
Guest:
Nicole Beckwith, Sr. Security Engineering Manager, Threat Operations @ Kroger
Topics:
What are the most important qualities of a successful SOC leader today?
What is your approach to building and maintaining a high-functioning SOC team?
How do you approach burnout in a SOC team?
What are some of the biggest challenges facing SOC teams today?
Can you share some specific examples of how you have built and - probably more importantly! - maintained a high-functioning SOC team?
What are your thoughts on the current state of SIEM technology? Still a core of SOC or not?
What advice would you give to someone who inherited a SOC? What should his/her 7/30/90 day plan include?
Resources:
EP180 SOC Crossroads: Optimization vs Transformation - Two Paths for Security Operations Center
EP181 Detection Engineering Deep Dive: From Career Paths to Scaling SOC Teams
EP58 SOC is Not Dead: How to Grow and Develop Your SOC for Cloud and Beyond
EP64 Security Operations Center: The People Side and How to Do it Right
EP73 Your SOC Is Dead? Evolve to Output-driven Detect and Respond!
Guests:
A debate between Tim and Anton, no guests
Debate positions:
You must buy the majority of cloud security tools from a cloud provider, here is why.
You must buy the majority of cloud security tools from a 3rd party security vendor, here is why.
Resources:
EP74 Who Will Solve Cloud Security: A View from Google Investment Side
EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use
“The cloud trust paradox: To trust cloud computing more, you need the ability to trust it less” blog
“Snowcrash” book
Guest:
David LaBianca, Senior Engineering Director, Google
Topics:
The universe of AI risks is broad and deep. We’ve made a lot of headway with our SAIF framework: can you give us a) a 90 second tour of SAIF and b) share how it’s gotten so much traction and c) talk about where we go next with it?
The Coalition for Secure AI (CoSAI) is a collaborative effort to address AI security challenges. What are Google's specific goals and expectations for CoSAI, and how will its success be measured in the long term?
Something we love about CoSAI is that we involved some unexpected folks, notably Microsoft and OpenAI. How did that come about?
How do we plan to work with existing organizations, such as Frontier Model Forum (FMF) and Open Source Security Foundation (OpenSSF)? Does this also complement emerging AI security standards?
AI is moving quickly. How do we intend to keep up with the pace of change when it comes to emerging threat techniques and actors in the landscape?
What do we expect to see out of CoSAI work and when? What should people be looking forward to and what are you most looking forward to releasing from the group?
We have proposed projects for CoSAI, including developing a defender's framework and addressing software supply chain security for AI systems. How can others use them? In other words, if I am a mid-sized bank CISO, do I care? How do I benefit from it?
An off-the-cuff question, how to do AI governance well?
Resources:
CoSAI site, CoSAI 3 projects
Guest:
Questions:
Resources:
Guests:
Jaffa Edwards, Senior Security Manager @ Google Cloud
Lyka Segura, Cloud Security Engineer @ Google Cloud
Topics:
Security transformation is hard, do you have any secret tricks or methods that actually make it happen?
Can you share a story about a time when you helped a customer transform their cloud security posture? Not just improve, but actually transform!
What is your process for understanding their needs and developing a security solution that is tailored to them? What to do if a customer does not want to share what is necessary or does not know themselves?
What are some of the most common security mistakes that you see organizations make when they move to the cloud?
What about the customers who insist on practicing in the cloud the same way they did on-premise? What do you tell the organizations that insist that “cloud is just somebody else’s computer” and they insist on doing security the old-fashioned way?
What advice would you give to organizations that are just starting out on their cloud security journey?
What are the first three cloud security steps you recommend that work for a cloud environment they inherited?
References
EP86 How to Apply Lessons from Virtualization Transition to Make Cloud Transformation Better
For a successful cloud transformation, change your culture first
Building security guardrails for developers with Google Cloud
Guest:
Adam Bateman, Co-founder and CEO, Push Security
Topics:
What is Identity Threat Detection and Response (ITDR)? How do you define it?
What gets better at a client organization once ITDR is deployed?
Do we also need “ISPM” (parallel to CDR/CSPM), and what about CIEM?
Workload identity ITDR vs human identity ITDR? Do we need both? Are these the same?
What are the alternatives to using ITDR? Can’t SIEM/UEBA help - perhaps with browser logs?
What are some of the common types of identity-based threats that ITDR can help detect?
What advice would you give to organizations that are considering implementing ITDR?
Resources:
Guest:
Zack Allen, Senior Director of Detection & Research @ Datadog, creator of Detection Engineering Weekly
Topics:
What are the biggest challenges facing detection engineers today?
What do you tell people who want to consume detections and not engineer them?
What advice would you give to someone who is interested in becoming a detection engineer at her organization?
So, what IS a detection engineer? Do you need software skills to be one? How much breadth and depth do you need?
What should a SOC leader whose team totally lacks such skills do?
You created Detection Engineering Weekly. What motivated you to start this publication, and what are your goals for it? What are the learnings so far?
You work for a vendor, so how should customers think of vendor-made vs customer-made detections and their balance?
What goes into a backlog for detections and how do you inform it?
Resources:
Zacks’s newsletter: https://detectionengineering.net
EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil
EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity?
“Detection Spectrum” blog
“Delivering Security at Scale: From Artisanal to Industrial” blog (and this too)
“Detection Engineering is Painful — and It Shouldn’t Be (Part 1)” blog series
Guests:
Mitchell Rudoll, Specialist Master, Deloitte
Alex Glowacki, Senior Consultant, Deloitte
Topics:
The paper outlines two paths for SOCs: optimization or transformation. Can you elaborate on the key differences between these two approaches and the factors that should influence an organization's decision on which path to pursue?
The paper also mentions that alert overload is still a major challenge for SOCs. What are some of the practices that work in 2024 for reducing alert fatigue and improving the signal-to-noise ratio in security signals?
You also discuss the importance of automation for SOCs. What are some of the key areas where automation can be most beneficial, and what are some of the challenges of implementing automation in SOCs? Automation is often easier said than done…
What specific skills and knowledge will be most important for SOC analysts in the future that people didn’t think of 5-10 years ago?
Looking ahead, what are your predictions for the future of SOCs? What emerging technologies do you see having the biggest impact on how SOCs operate?
Resources:
“Future of the SOC: Evolution or Optimization —Choose Your Path” paper and highlights blog
“Meet the Ghost of SecOps Future” video based on the paper
EP58 SOC is Not Dead: How to Grow and Develop Your SOC for Cloud and Beyond
The original Autonomic Security Operations (ASO) paper (2021)
“New Paper: “Future of the SOC: Forces shaping modern security operations” (Paper 1 of 4)”
“New Paper: “Future of the SOC: SOC People — Skills, Not Tiers” (Paper 2 of 4)”
“New Paper: “Future Of The SOC: Process Consistency and Creativity: a Delicate Balance” (Paper 3 of 4)”
Your feedback is valuable to us. Should you encounter any bugs, glitches, lack of functionality or other problems, please email us on [email protected] or join Moon.FM Telegram Group where you can talk directly to the dev team who are happy to answer any queries.