EP112 Threat Horizons - How Google Does Threat Intelligence

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts. as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. You can also find us and our other cloud podcasts at cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please hit the subscribe button in your podcasting app of choice. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we are forging new horizons today.

Threat Horizons, to be exact.

Threat Horizons. Is that like when you're afraid you're going to fall off the edge of the world? Is that a threatening horizon? What's a threat horizon?

Threat Horizon is actually a threat intelligence report by Google. OK, sorry, I'm going to go somewhat boring, but—

Oh. Is that like an event horizon? How did horizon get into this title anyway?

Actually, I don't know. I think when the report was being named, I was technically reporting to a marketing team, but they didn't ask me. They didn't ask me. So— but at the same time, I have to acknowledge that the name is kind of cool, and it's cool for multiple reasons because a lot of other vendors kind of repeat the same naming themes— threat intelligence report, threat analytics report, threat report. And to me, Threat Horizons name really does stand out. I'm sorry. We argued about whether Chronicle is a good name, and I think it's an awesome name, and you think it's maybe not so great. But Threat Horizons, to me, I was instantly in love. I really love the name of the report.

No, I think it's a good name, too. I might be ripping on it, but it's a good name. Listeners, here's a fun fact. Anton and I once collectively renamed somebody else's product 2 days before it launched. That was one of the stranger things we've had to do together here at Google. It turns out we have the delightful pleasure of working together on things that are not just the podcast. So today we're talking about the Threat Horizons report. We're talking about some of the great stuff in it, and we get into some fun back and forth with our guest about what's actually scary in cloud versus what's actually common in cloud. Do you want to say anything about that distinction?

Actually, we've asked our guest, as you would hear in a few moments, what was the most surprising part. But what was the most not surprising? Crypto miners, ransomware, and to a lesser extent, data theft. But ultimately, the crypto miners and ransomware are 2 threats that at this point are very much not surprising in the cloud. Frankly, if you wake me up at 3:00 AM, that's a notorious Anton 3:00 AM test, and say, Anton, name one threat that's the most common in the cloud, I would go crypto miners, of course.

Yeah, of course.

I wouldn't do ransomware. I wouldn't say ransomware.

I wouldn't either.

But apparently it's common. And it's interesting how the surprising part is that it probably peaked, ransomware and crypto miners probably peaked according to our guest.

I think that that is a very optimistic take on some of the trends we're seeing. But let's not stall any longer. Listeners, please welcome today's guest. I'm delighted to introduce today's guest. Today we're joined by Charles DeBecque, Cyber Threat Intelligence Expert here at Google Cloud. Charles, we want to get right into it. Could you start out just by sharing a little bit about how is Google approaching threat intelligence? Is it, you know, what's special about it? Is it that we got the biggest sensors, the biggest team? What's special here?

Yeah, thank you so much for having me. Excited to talk about this today. So there's a few different elements that I think really make our perspective on this unique. I mean, as you referenced, first off, our data aperture at Google Cloud is really, really interesting in that we've got a huge portfolio we can draw from, not only internally at Google Cloud, but also looking across the Google enterprise. We really have a broad data aperture to look through when we're trying to understand what the threat landscape looks like for organizations. In addition to that, one thing I think that's really unique about some of the material that we're working on over in Cloud is this really specific focus on the cloud environment and how organizations using cloud environments can better protect themselves. A lot of times threat intelligence for organizations is looking at traditional endpoints or traditional on-prem environments. By really focusing on this cloud environment, we really have to think about things in a very unique format, not only from a threat landscape perspective, but also from a defensive perspective. So I think those elements really combine to make a really unique understanding and reports for us to better understand the landscape facing organizations today.

So let me pick at that a little bit, because there's nothing I like more than picking at things. What's different about cloud? Let's talk about that. Ooh.

Ooh.

That's like the whole point of the podcast, right? What's different about cloud?

Yeah, I love it. The way I like to think of it is that in a traditional environment, you have a lot more control and malleability to your organization's defensive posture. It's kind of like protecting your own backyard. You've got the fence there. You can decide how tall your fence is, what type of slats your fence is made of, what's in your backyard, and then how you protect things there. You have a lot of control and capabilities specifically that you can choose every element that's there. In a cloud environment, you have this interesting shared fate component where both sides of the equation have to be sort of on the same page to make sure that you're protecting yourself most effectively. And some of these elements may be in your control, and then some of them might not be. I liken this to being in more of like an HOA environment, right? You know, you can control some elements of it. There are some things you can do, but there's also some elements that are dictated by the homeowners association in this metaphor that you have to work around and use and work within to best protect yourself. But an HOA also is malleable, right? You can work with them and work together to make sure that you have the best backyard possible. And in the same way, you can work with your cloud provider, your cloud environment, to make sure you have the best defenses possible. And in that way, you can really move forward very effectively.

So, I don't know how I feel about cloud providers and HOA. And I really mean that. Like, I, in the physical world, and I don't want to make it into about real estate, but I tend to have a very negative view of HOAs. Now, in the cyber world, I kind of see where the metaphor works well, because even the guardrails example that comes up a lot in the podcast, it is kind of an HOA example, right? Like you can't paint your house red because rules. And if you do paint your house red in HOA, yes, you can still paint it, but then you'll be punished. So it's not a true guardrail where you're like, it's impossible for you to do it.

Well, so I live in a 3-unit building where the 3 owners are the HOA. And I have to say, one of the other owners does a really nice job of keeping the backyard in beautiful shape, and she does a much better job than I would on my own. So if we were to think about the sort of things that Google provides as the cloud HOA, I can kind of see the metaphor for that. I think it's— that's a unique metaphor. I have not heard this one before, Charles.

Well, I'm glad to bring you something new to the podcast. I'd hate to, uh, bring you stuff you've heard all the time. And I admit the metaphor may not be the perfect one, and I know a lot of folks have negative impacts with HOAs that they've I think the apartment metaphor might be a better one that you're referencing there, Tim, where I think that there's advantages to having some of those guardrails in place or some collective controls in place and enabling that sort of capability at a broader scale than just individually by the organization.

But I wouldn't take Anton's criticism of the analogy too personally, Charles. Anton is allergic to any form of authority that doesn't come from a place of sensibility, and he's got good reasons for that allergy. I just suspect that's what's influencing his view here.

By the way, I never really criticized the HOA metaphor. I was still processing it. I just said that my initial take was that HOA is a bad thing, but the metaphor— and so I don't want to be a cloud provider who bosses tenants around and annoys them. But at the same time, I do get the guardrails and the house value and the— I'm really mixing metaphors here.

And paving the roads and keeping the gate aft and all that.

Yeah, paving the roads. So I definitely see how CSP as an HOA is actually a workable metaphor. And the positives of HOA, in fact, may be more highlighted here. Thanks for using our podcast mug, Tim.

Listeners, we're on video together, and I'm drinking from our podcast mug. So we should stay a little bit on track here and not get totally derailed. Anton, I think the next question comes from you.

Right. And I mean, I wanted to bring the discussion, otherwise very fun, back to not just threat intel, but specifically the Threat Horizons report. We've released 5 by the time we're recording. And while I understand roughly what's unique about our threat intel approach, would you be able to talk a bit about the report? You are part of the team building the report. And so what is magical about it? Because as a former analyst, I've seen a lot of vendor threat reports. And there was a period of time when pretty much every vendor who was serious had a threat report. Now, to me, Threat Horizons is better, and it's more interesting, but I can't quite articulate why. So can you do that?

Yeah, tell us why it's good.

Absolutely. I'd love to. So there are a couple key things here. First off, when you look at the data perspective, you know, as an analyst myself, when I look at this report, what I really like about it is that we're diving into some of the data that we're pulling back in terms of what are the actual threats being faced by organizations in cloud environments in terms of how are threat actors getting in and what are they doing once they're there. And given our unique ability to have insights here as Google Cloud, we can really get a good perspective on what's happening on the ground from a real-world perspective, not just purely theoretical or abstract components here. So what I really like about this report is you can jump right into it and immediately say, okay, if I'm trying to understand how to best protect myself as an organization using cloud environments, what should I be doing? You can look at the first few pages and immediately see, boom, crypto miners are one of the top threat vectors that we're observing, so I should be monitoring for that. Or one of the top things that we're seeing for how threat actors are getting in is by leveraging weak or no credentials. So I should make sure that that's something that I'm tracking and scanning for. But this sort of real-world data that we're able to pull back, I think, really is useful and allows for immediate impact from the report in a way that a lot of other reports may not be able to accomplish based solely on the fact that we've got great data capabilities here.

Yep. And I think I like that because I've seen a lot of vendor reports skew in favor of that vendor tech. Pretty much every problem seems like it's solved by that vendor tech. We are not. We are pretty open by saying, hey, people run cryptominers in the cloud. There are criminals out there who do bad stuff. Like, there's no real Now, I want to evolve this a little bit and really rush this so that I can ask my favorite question before Tim jumps in. And that's the question about the cloud threats. So, for a couple of years, I've been a little obsessed about this because I do talk to some people who are kind of lift and shifters, and they mostly describe their traditional threats. And they say, these threats are the most important in the cloud, ransomware, I don't know, something else.

Yeah.

And I say, wait a second, these are threats to your data center. And they say, yes, what's your point? My cloud is my data center.

Oh.

But then I go talk to other people who bring up the esoteric, you know, fancy container escapes and API abuses. And then they say, no, no, no, no, no, threat landscape is completely different. Nothing to do with what I had. And this causes me to have a bit of a headache because threat assessment becomes very difficult. So, we've been asking many guests, what threats are prevalent in the cloud? What are the realistic threats to client cloud environments today? And you have the best data from pretty much everybody on the planet to answer it. So, why don't you answer it?

Well, first off, I should clarify, you know, I'm sure there's lots of great datasets out there. I don't want to denigrate any of our other colleagues in the field here. It's a team sport. We're all working together on this, but I am thrilled that we can present some really great data in this arena. So with that caveat in place, I would say that to me, the most prevalent threat, the threat that we're seeing most commonly in my experience is crypto mining, which I know you hear crypto mining and I, I get, you know, 20% of your viewers just turn the podcast off cuz they're already bored cuz people don't wanna talk about crypto mining.

No hanging up listeners.

Yeah, this is important, so keep listening. But crypto mining is something that's very, very frequent. It's something that happens a lot of times. And I think the main reason for that is as a threat actor, it's very easy to monetize. You know, you're immediately turning your illicit access into money. What's easier than that? And at the end of the day, that's what matters is how big of a TV I can buy as a criminal actor to be able to— with all this bad stuff I'm doing. So crypto mining, I would say most prevalent activity. Most impactful, you know, what do we see? What I would say has the biggest impact for an organization, there's a lot of different potential answers here. So I'm not gonna say quite as authoritatively on this one. Ransomware is a good answer for sure. I'm actually gonna go with data theft. Okay.

In the cloud?

Yeah. What does ransomware look like in the cloud?

Okay, we've asked this before and now we're gonna—

Ask it again.

We caught somebody who actually has the data, so.

Absolutely. So ransomware in the cloud looks very similar to ransomware in on-prem environments, in my experience. The biggest difference you see is it comes down to reconstitution capability and also that second-order effect of the data theft component that we're seeing with them.

All right, so break that down for us. What is reconstitution? What the heck does that mean?

Recovery? Backups?

No?

Is that the same as resilience?

So yeah, resilience is a very similar concept here. So reconstitution ability is the ability for an organization to get critical functions back online in a timely and effective manner so as not to negatively impact business operations. That's a really fancy way of saying, if you're hit with ransomware, how quickly can you get it back online so that hopefully none of your customers or users notice? because you got hit by ransomware. And it is a lot easier for organizations oftentimes in cloud because there are a lot of capabilities sort of baked into the backend to enable that. So ransomware may not have as large of an impact in some of those cases. That said, we are also observing that threat actors see the same trend, right? They're noticing that organizations in cloud environments may have better capabilities for reconstitution, and they're actually starting to try and target backups and reconstitution capabilities when they get into cloud environments and use ransomware so as to make it less effective. That was kind of a wall of words. Does that all make sense?

It does make sense. It does make sense. And I think that it's not so much that the ransomware attack itself or the malicious op is different, but what you can do as a defender is quite different. Because if your tape is in a flooded basement and your servers are encrypted, then you're cooked. You don't have a response. But in the cloud, it's really unlikely that your backups and recovery capabilities are that degraded.

I'll say it's unlikely if you've taken the right steps, defensive precautions ahead of time, and recognize the value and are taking advantage of the cloud defense capabilities that are sort of baked in and available for you to use. But that's a notable if, because just because you're in a cloud environment doesn't mean that you've automatically enabled all these capabilities for your organization. This is something that If you're listening to this right now and you're saying to yourself, oh geez, do I have that stuff enabled? You should probably go double-check that now rather than waiting for something to happen.

So basically, crypto miners go into the most prevalent threat bucket, while data theft and ransomware go in the most damaging threats bucket. These are the conclusions, right? Anything else on that theme?

I would just say that data theft is a multifaceted, complex issue, and the big challenge you run into there is data theft can have long-term ramifications in terms of how long it takes for the organization to recover from data theft. As a result, that sort of impact of an incident can span not just, you know, days or weeks, but months into years. That's why I would say it's most impactful, because of the length of those incidents and how much broad array of impact they can have.

Yeah, that makes sense. I could certainly see that. So I want to shift gears and ask one of my favorite questions, which is to ask you to predict the future, which, uh, you know, predicting things is hard, especially the future, but But with it being the, just the start of 2023, what should companies be looking out for this year in particular?

Predicting the future is always a bit of a challenge. I think for me, what I'm looking at this year is diversification by threat actors. What I mean here is we were just talking about crypto mining and ransomware. Last year we were talking about crypto mining and ransomware. The year prior to that, we were talking about mostly ransomware. But if you're kind of noticing the theme here is that from a criminal threat actor perspective, we're talking about a lot of the exact same attack vectors over and over again. And I think that in 2023, threat actors are probably gonna start diversifying and looking for new ways to monetize their illicit access and engage in criminal activities that are a bit different from what we've seen in previous years, just for a variety of reasons. First, we're not seeing as good of a return on investment. I think there's been a few articles just in the last few weeks about how ransomware isn't seeing as good of a return on investment based on their activity because less people are paying ransoms. Second, we're seeing increased law enforcement activity in this space and a lot more heat being driven onto criminal actors that are engaged in this particular type of activity. So as a result of these pressures, I think threat actors are going to start trying to branch out and find other ways to engage in malicious activity that we haven't seen just yet, because it's not as profitable as it used to be and it's more dangerous. So why would you keep doing it?

So it's probably a reasonable prediction. I think it makes sense to me, but at the same time, Won't there be enough organizations to do things badly in various clouds so that ransomware and crypto miners still stay a sizable chunk of the pie, but maybe it stops growing, or maybe the slice of the pie is shrinking?

Yeah.

But they won't be gone next year. That's not what you're predicting.

No, no, not at all. And that's a more accurate way of putting it. The way I imagine it is if you imagine the pie chart right now is a big chunk of the pie is crypto miners, the next biggest chunk is ransomware, and there's a little tiny slice of everything else. I'm imagining that little tiny slice expanding significantly over time because I think that we're gonna see that. But those other 2 slices are still gonna probably command the vast majority of activity that we're observing just because they still do remain some of the best ways to monetize. The other thing I think we'll start seeing more of in 2023 and beyond is the impact of multi-cloud incidents and organizations using multiple cloud providers for different purposes and having those cloud interactions being targeted by threat actors. Just because this is gonna become more and more prevalent. We're seeing more organizations using this sort of multi-cloud model. And as a result, threat actors are also evolving their tactics to take advantage of these multi-cloud interactions to be able to move laterally within organizations for potentially malicious purposes.

How do bad guys move laterally between clouds? Is this like taking advantage of network connect? Is it taking advantage of identity interconnect? What, what's that looking like?

You know, it could be an array of different ways to do that. And both those methods you mentioned—

People using the same password on both clouds?

Oh God.

I don't know. So I think it could be a variety of different methods.

For sure. I think the one that I have the most experience with would be identity over-permissioning between clouds, where it's just an identity issue, right? A threat actor gains access to identity permissions they shouldn't have within one cloud, uses that to leverage that access into the other cloud based on the identity over-permissioning or over-allowance. And then that allows for that sort of cross-cloud shenanigans is the technical term.

Cool. So it's like IAM mistakes strike again. This is kind of the If I give my process system or application in one cloud too much access to another cloud, attackers can ride on that and get into the other cloud. Roughly, that's what you said.

Yep, exactly.

Yeah. Okay, cool. So when we talk about the reports, a lot of people say, hey, give us the key takeaways. And frankly, I would say it's a little bit boring. So what is the most surprising thing? Like, you've worked on the report, right? Is there one thing that surprised you the most, and perhaps the thing that would be the most surprising to the audience? I don't know. Like, give us the surprises—not crypto miners and ransomware, by the way. Sure.

So I'll say the thing that surprised me the most personally was the prevalence of credential issues, and that's mostly because I can't believe it's 2023 and we're still dealing with credential issues. 1980s are back.

They want their attacks back.

Yeah, but they're different credential issues now, right?

So the main issue that we're that I'm observing in my experiences is that. Organizations allow for quick spin-ups of an instance in their cloud environment, and some person says, oh, I'm just going to borrow this for a hot second. I just need to set something up real quick so I can get my job done. And in the time that it takes them to spin it up, use the instance, and then shut it down, a threat actor has already scanned it, taken advantage of it, and then has moved laterally within the organization. That sort of quick spin-up, well-intentioned credential error, to me, is something that we absolutely need to prevent as an industry. And I'm just shocked that it's still such a big problem, but it continues to be just a rampant issue from my experiences anyways.

So how can an organization build org structures to prevent this? Because it's surely not a technology problem, it's an org problem. What does an org do to get this right?

Yeah, I love that you think of it from that perspective because I really think it is twofold, both technological and policy-based. I think that there's a few different ways you can do this. First off, from a technological perspective, just to briefly address that, Yes, you can set up base defaults. You can set up default images and what have you to make it so that it's easily accessible and easy to spin up a compliant and effective machine with proper credentialing in place. From a policy perspective, which is what I think you're more interested in based on your question, there's a few different steps I would take here. First off, as an organization, make sure you have a policy. A lot of organizations may not actually have specific policies in place for spinning up machines, And make sure that you have effective disciplinary controls in place for people who aren't engaging or following the policy effectively. A lot of times there may be policies in place that aren't enforced or aren't monitored. So making sure there's a monitoring process in place as well is absolutely critical. And then ultimately, I think it's gonna come down to making sure that when machines are spun up that aren't compliant, it's gonna be either A, a race between yourself and the criminal to find out who can get to it first. Or B, it's going to be something where you have to make sure you have good enough lateral movement detective and protective controls to prevent the criminal from moving further into the organization. Or it's going to be an issue of making sure that the issue doesn't come up at all by having punitive controls in place so that when somebody spins something like this up, they're subsequently disciplined significantly.

So given what you said about erase, I would be remiss to not Then ask, you know, I'm the threats PM for SCC, but I do like prevention compared to cure. And so is there good hardening advice you can give our listeners other than, of course, use the real-time detective controls embedded in SCC? What else could people be doing beyond using SCC Premium for its real-time detection on misconfigurations and threat activity?

You sound like an ad for SCC team, by the way. Why is that?

Sorry. Sorry. Well, I was going to say, you like SCC?

That sounds like a pretty, pretty darn good product.

Let's talk about it.

You know, it's funny, I've done 105 episodes of this show and I don't think I've ever plugged my product before. But listeners, if you don't know this, I'm the PM for a product that does exactly what we're talking about.

Well, it sure sounds like a great product. I'd love to learn more about it.

It sure is.

Maybe in a follow-up meeting. Yeah. But in terms of, you know, some counterintuitive or less common things than SCC Premium, one thing that I think that a lot of organizations don't think about that would actually be a very effective control, I think, is billing alerts. We're always thinking about technical solutions and we're thinking about network protections and hardware layer protections and application layer protections. But a very common thing that could, I think, really protect organizations is alerts for when your account suddenly starts spiking and billing way more than it's expected to. That's a very simplistic thing. But when you think about what a crypto miner does or what a lot of activity might do, in your cloud environment that you're not expecting, that's from a criminal actor, one of the first things it does is it spikes your costs because they're using tons of cores to do crypto mining. And so this is something that organizations could use to drastically reduce the potential outlays in an event like this. And it's almost a matter for most organizations of just clicking a button and saying, yes, do this if it gets too high. It's very easy, very cheap, very straightforward, and can result in massive savings in the event of an incident.

I think I've heard that first from Corey Quinn, the Cloud Economist, who was kind of pointing out that looking at bills is the best way to detect threats if you have nothing else. So, it's interesting how that topic comes back in this discussion because it's kind of like a— it's a very well-known thing in very narrow circles, it sounds like.

Oh, Corey is a very wise person.

Well, there's that. Yes, Corey is a very wise person.

So, I think it tends to be one of those things where the finance arm oftentimes isn't talking to the technical wing for a variety of different reasons. But this is a great opportunity for them to work together, collaborate, and make our defensive posture better together because we're all in it together. That's my big takeaway. Perfect.

So, I want to switch gears given that we have little time left. So, and one thing that came up in the last report specifically is OT, operational technology. And I, in my initial take was like, wait a second, cloud and like nuclear power stations and like municipal water systems, what do they have in common? So, What's the connection between Threat Horizons research and the OT? Like, can you give us a brief intro into the topic, please? And of course, we'll point people to read the report.

Absolutely. So the takeaway here is that organizations are moving their operational technology infrastructure into cloud environments for a variety of reasons that I'm sure you've discussed many times on your podcast already as to why there's benefits moving to the cloud. As a result of the shift of OT infrastructure into cloud environments, Those connections between the disparate operational technology devices and the cloud makes it so that it's a ripe environment for threat actors who are looking to target OT devices. And I'm sure you've talked about this many times, but I'll just briefly say that when we're talking about operational technology, it's not just power plants, you know, hydroelectric, nuclear, what have you, but also I think something that's worth consideration here from the medical industry is medical devices are also, in my mind, part of the device category that we should be considering when we're looking at device control from cloud-based environments. As we see threat actors adapting and getting better at using cloud environments, taking advantage of cloud environments, that also means that they have a better capability to take advantage of infrastructure hosted within those environments or operational technology, which poses a new type of risk or a new category of risk, I would say, for users and owners of operational technology components.

That makes a lot of sense. So unfortunately, we're just about at time and I'd love to ask our traditional closing question. One, give us some recommended reading, like obviously all the Threat Horizons reports. And 2, one tip on how organizations can improve the value that they get from their threat intelligence.

Recommended reading, I'd say outside of Threat Horizons report, current and prior. The other main thing I would recommend for your listeners is to make sure that they are keeping up to date on the latest and greatest news in general. And I don't have a specific news recommendation here, but I would just say that the threat landscape is constantly changing. And so if you're not reading at least 2 to 3 cybersecurity websites a day to make sure that you're up to date, then you are doing yourself a disservice by not keeping track of the latest and greatest in cybersecurity and what's going on in the threat landscape.

Listeners, you hear that? You must scare yourself 2 to 3 times a day.

2 to 3 times a day at least.

You must scare yourself that often.

It's like vegetables on the food pyramid. In terms of how to better improve the value you get from threat intel, I would say the best way to do that is to make sure that you are Understanding what your organizational posture is, because you don't know, won't know how to protect yourself until you know what's there to protect. So if you do nothing else, make sure you have an understanding of what your assets capabilities are as an organization so that you know what threat intel you should be paying attention to and which stuff you can conveniently set to the side until later.

I really like that answer. I always tell people you can't manage what you can't measure. You certainly can't secure what you can't see.

I think that last part is what really strikes me. Absolutely agree.

Yeah. Charles, thank you so much for joining us today. Listeners, I hope you enjoyed this as much as we did.

Thank you so much for having me. My pleasure.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Thank you, Ronnie.