EP113 Love it or Hate it, Network Security is Coming to the Cloud

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts. as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want to listen to us every Monday, please hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, ordinarily I say, oh, what are we doing this week? But today I'm so excited. I will tell you, we are talking about network security for the cloud that actually makes sense.

Indeed. And to me, the tricky part is not connecting network security to the cloud because people do that. And we made enough snide remarks about people who bring their firewall appliances with them in the cloud.

No more snide remarks from us.

Yes.

I think you and I can stick to that resolution for about 2 minutes.

Yes, correct. And this is the episode where there are network security in the cloud that's done the cloudy way and solves cloud-specific network security problems, which Some people intuitively think should exist, but they don't know what it is.

And that's what I love about this episode and about today's guest. We have somebody who's truly knowledgeable in network security and truly knowledgeable about what network security challenges exist in the cloud and how to solve them. So perhaps without any further ado and having made it through without a single snide remark, let's turn things over to today's guest. I'm delighted to introduce today's guest, the man with the most profitable pig I've ever met, Martin Resch, the CEO at Netography and the creator of Snort, among many other things. Martin, thank you so much for joining us today. We want to talk about a perennial favorite topic between me and Anton, which is network security in the public cloud. You know, we used to have networks as a perimeter. Now you've got APIs and identities. We've had people compare this to onions and garlic at one point. In your opinion, as one of the leading minds in this area, are networks still relevant? Do they still matter?

You know, yeah, they do. Yeah. Everybody would like them not to, but they keep, you know, Every time you try to get out, they pull you back in. It's really funny because, you know, we talk about this, my role at Netography, I kind of coined this whole thing around atomized networks. I'm not going to flog it. But, you know, the interesting thing is that when the pandemic hit and everybody got sent home, hey, you know, we're all going to work from home, just 2 weeks, just get your job done. And 2 weeks turned into 6 weeks and 6 weeks turned into 6 months. And then all of a sudden people are just getting their jobs done. They start standing up things all over the cloud. And then they started kind of wiring things together as time marched on. So, you know, start building dependencies between cloud applications and datasets and even reaching back into the on-prem or multi-cloud kind of stuff to do that. And then all of a sudden, you know, now we're back into this kind of post-pandemic world, although, you know, whatever level of debate you want to give to that.

This is a cloud security podcast, not a pandemic security podcast.

Yeah.

So, you know, we can talk about that, I'm sure, for the whole thing. But So, we're into this world now, this kind of post-pandemic-y, let's call it.

Yeah.

And, you know, we're talking to all these security organizations, SOCs, and CISOs, and, you know, operators, and things like that. And they're like, we're flying blind. Like, we really do not feel like we have a good handle on what we've got and what it's doing. And, you know, these are really fundamental questions. Well, if you don't know what you've got and what it's doing, how are you securing it? What kind of security can you do? Now, you know, you have all your cloud orchestration tools, and you have, Lots of things out there like CSPM that are supposed to kind of give you the full story of what's going on and how you should be configured versus how you are configured and things like that. But, you know, it seems like there's still a pretty significant gap between what you think you're configured to do and what you're actually doing. And that's why there's still this need for network security because, you know, despite the fact that you may feel like you've got your hands around your cloud workloads and things like that, what are they talking to and how are they talking to them? And what is that thing over there? Why is it talking to, you know, That keeps coming up. I didn't even know we had that. I didn't know those things were talking to each other. I didn't know we were still using that. That is not compliant. I thought we were in compliance. How did we get out of compliance? You know, all those kinds of things keep popping up. So, and a lot of that is cued via, you know, whether or not you can pay attention to what's going on in your network, because what else is going to tell you in a lot of cases, right? I've got all this scan and report stuff. It's like, I scan the configuration, I generate a report, please service it. You service the report, you change the configuration, somebody comes behind you, you know, you have, you know, whatever configuration drift and things like that. And then all of a sudden things are happening and nobody's mining the store and the network is a great place to get that information. So yep, still need for it.

So you wanna treat the network as the last real source of truth?

I mean, it's always been, you know, the—

That's a 1990s quote. Network could be packets, not on the sniffer, that didn't happen. So I'm not sure.

It's not wrong though. It's not wrong. Like it is a fundamental, it is the ground truth. What is happening on the network? If you can suss out what's happening on the network, then you have a verifiably real set of information that is generated by actual workloads, equipment, whatever.

So to kind of drill down into the same topic, of course, people, some people still equate firewalls and similar devices with network security. So on this podcast, we occasionally mention that when you migrate, don't get your firewall appliances, you know, in a big bag and don't drag them with you in the cloud. But people do that. And so if you don't take firewalls with you, then how do you control access? So maybe what's your take on the firewalls in cloud network security? And of course, you know, I'm going to ask about IDS next, but don't answer it yet.

Well, you know, I don't disagree that bringing your appliances to the cloud is not a great model. You know, instead of using kind of the native capabilities of the cloud, bringing along an appliance model with, all of its licensing and management overhead and this kind of curation overhead and things like that. I personally am dubious about the value of doing that. I understand if you have— you want an equivalent experience across your entire deployed plant, if you feel like you can get it by deploying cloud appliance firewalls, okay. Like, say you're a big NGFW shop and you really like the way your NGFWs work and what they can tell you and things like that. I mean, I get it. It seems like, you know, kind of software-defined networking, SD-WAN kind of stuff can do a lot of the things that you probably want to do as far as the fundamental function of 5-tuple filtering or, you know, a lot of application filtering, especially when you can very tightly define where the applications live and how, what kind of connectivity they need and things like that. So I think it's kind of, it's like a, difference in stance, but generally speaking, not a huge fan of appliances in the cloud because I did appliances not in the cloud and also appliances in the cloud. And that model, that curation model, that management model of I've got a central management platform that talks to all my deployed footprint and the deployed footprint is managed and updated by that, it's clunky in a cloud world, I feel.

Clunky. So, but this is, I think that there's subtle nuance to this because And again, not talking about IDS quite yet, but what about firewall as a virtual appliance? Yes, of course, that's mostly everybody is kind of at least mildly disdainful of this approach. But firewalling code, distributed firewalling, firewalling as part of a cloud provider platform, like that part is okay though. I still can control access to network. I still feel like it's a good thing to do, but maybe it's me, my upbringing in the '90s is talking. I don't know. Yeah.

No, I don't disagree with you. I think that you're right. Like, there's got to be some capability to, you know, I call it like, prepare the battlefield, right? You have to dig your trenches and put in your bunkers and things like that. You have to be able to set the table and define what is allowed and what is not allowed, instead of necessarily depending explicitly on like the application developers to do it or the cloud ops team to spell it out. So yeah, from that standpoint of defining kind of the fundamental compliance that you require in the environment that is enforceable at the quote unquote security level, I think that that function, yeah, definitely still has use.

Okay, then one of us is going to ask, what about IDS?

What about IDS?

What about IDS? We both ask. Okay, this is one question that we both ask at the same time. What about IDS?

IDS will never die. IDS is never going away forever. I'm just talking network IDS. There's lots of flavors of IDS, but like, If we're just talking network IDS, network IDS has some challenges right now due to encryption and the problem of actually getting to the right place to see what you want to see, right? So I have this thing that I talk about, the issue of getting your capabilities where you need them when you need them.

Hmm.

With ephemeral workloads and dispersed environments that we have in the enterprise these days, that's difficult. And, you know, this is almost like— I've talked a little bit about this in the work context. One of the, you know, the Faustian bargain that we made when we went to the cloud and decided we were all going to do zero trust is we basically said, we're going to encrypt everything, which is going to blind every deep packet inspection system that we've got, or we're going to disperse things and blind them, make it really hard to get in the place where I can see stuff. So what that does, and I've said this for a long time, even back into the pre-Cisco days, you know, if this is the way that we're going, every device becomes an island. They all have to be responsible for their own defense. Now, we can orchestrate that defense at kind of a fleet level where we're orchestrating our entire fleet of workloads, devices, so on and so forth out there. But this function of being able to detect intrusions when all else has failed, like, you know, all of your compliance stuff, your GRC stuff, and your identity and access management, and your zero-trust network access, and all this stuff is supposed to prevent the bad guys from getting anywhere close to you in the first place. And yet here we are. I still have a job, which means it's not going well. So as a result of that, you know, this fundamental need for detecting, hey, we are in fact under attack, or hey, we have been compromised, now we got to do something about it, that's a big problem still. So whether it's a classic network IDS that's doing deep packet inspection and packet sniffing, or something, an old-school idea that's brought back to light, like network node IDSs— I don't know if you remember those, but back in the late '90s, we used to talk about, hey, what if I just did the Deep packet inspection on the device itself that was being protected, right? So Black Ice did that. There were some other projects out there that did that. And then we get into host-based IDS, right? Looking at the logs, looking at the activities. Yay, all those fancy buzzwords and acronyms.

That theme is alive today. People do drop, people do roll network IDS sensors into every cloud image. I've seen people do that. And whether deep in my heart is a good idea, bad idea, debatable, but people do do that. So network node IDS, from that era is alive in 2023.

Yeah.

There's some related work I'm working on that I wish I could talk about right now, but we'll have to have you back on the show in like 9 months so we can talk about the thing I'm building right now. And I would love your thoughts on it. Yeah, cool.

Be happy to.

I like this philosophy. You're really making the IDS sound like the last defender of the last defenders.

I mean, it's like, if it all worked great, then we wouldn't have a threat hunting industry. We wouldn't have MDR. We wouldn't have, you know, still have NGFWs and IPSs. The NDR world wouldn't exist. All these things are still out there, and whether or not they're prevalently used in the on-prem world, if they're used in the cloud, I mean, we've got CDR now, cloud detection response, as a new acronym in our belt. That stuff exists because there's only so much that you can do. And I mean, let's face it, you know, the Uber hack was a great example. So, you know, spam the MFA until some, you know, a user capitulates 'cause they're sick of seeing the messages on their phone.

Mm-hmm.

Guy gets in, immediately goes to the cloud environment. I mean, they had all the stuff, but you had an authenticated user who said, I would like to use my authentication, please. And, you know, whatever level of attestation needed to be there was there, and they got in. And, you know, apparently from what we understand, the Uber guys didn't really know that they'd been compromised until this guy popped up on their Slack server and said, hey, look what I found. And it's like, okay, well, that's awkward. But I'm definitely not victim blaming here, right? These are very large, complex systems that everybody is operating and everybody's doing their best, right? They have all the tools that they should have. But like when that stuff happens, it's problematic because now they're outside of the box, right? So you'd find a box that you think everything's gonna operate within. And once somebody gets outside of the box, what have you got that's capable of seeing it, detecting it, letting you know that something's up, things like that. Now we have all the fancy ML AI technologies that are supposed to surface anomalies for you, but a lot of times it's just, you know, Hey, this model tipped over and something weird happened. You should go check it out. And that's not something that's discretely actionable. That's like, you know, you're not sending people's pagers off at 3:00 AM for that typically.

I think you're winning the Understatement of the Year prize with this by saying that it's not discretely actionable is, to put it mildly, an understatement, right? It's possibly hours of painful agonizing for a defender with possibly not ever figuring out what actually happened at the end.

Yeah, I've become much more, you know, I've become much gentler in my silver years talking about security technology failures. But yeah, it's, you know, the ML and AI stuff, there's things that it can do very capably, but a lot of it, especially when you get into the kind of this anomaly detection, telling me when people get outside the box that I set up, it gets pretty difficult to give really meaningful information that you can turn around really quickly.

Yeah, we've certainly seen that. Internally and listeners, you should go back to the episode we had with Mike Sinnoh about defending Google, where we discussed some of our ML capabilities in that area. So I want to bring us back to cloud a little bit and focus on, are there new kinds of network threats we should be worrying about in cloud? Surely, you know, what you said about more islands is really interesting. What else changes in cloud in particular for network security?

You know, the ephemeral nature of things certainly is Presents unique problems, right? So we used to have data centers where things were relatively static, and I could set up a relatively static policy. Now I need to be much more contextually aware of the environment that I'm protecting and use that information. Now, if I'm doing things like sidecarring, for example, an IDS onto a workload that is ephemeral, then that IDS can be set up for that workload. But, you know, a lot of security technology, especially as you get kind of farther through the attack chain, so to speak, where you go from kind of scanning and prospecting to your compromise to exploitation, it needs more and more kind of specificity. It needs more kind of situational awareness to do its job. And that's difficult to get in cloud environments unless things are very tightly coupled. So that's something that's kind of problematic. And I think to some degree, when you do an architecture that is tight like that, it also becomes kind of brittle. Like, the dynamism of the system becomes difficult to kind of define in a way that is useful for security systems. So for example, in the old days, you could, you know, I always recommended to people when they were deploying Snort, set up detection for the things that, you know, could be a problem in your environment, and then set up detection, you know, the next level of detection that you should be doing is stuff that should never happen in your environment.

Mm-hmm. Mm-hmm.

People usually do step 2 Almost nobody does step 2, right? In the cloud, 2, right? So defining what should never happen, like somebody should have enough kind of, you know, they should be dialed in enough to be able to figure out, okay, well, this is a workload and it does the following 3 things. Things that it should never do would include, you know, XYZ. It should never accept an SSH connection from the outside world, for example. It should never do, you know, blah, blah, blah. Nobody does that because, you know, you can set up these kind of tripwire detections that are pretty straightforward for stuff that just shouldn't happen. And like, you know, but you got to have a clue to do it.

Mm-hmm.

And you've got to have time to do it. And you've got to kind of have, in a lot of cases, the direction or remit to do it. You know, nobody told you to put that anomaly detection rule in that system. You know, that's not your plane, that's the tech player's plane. Just land the plane on the carrier. So, that's the issue that you frequently get into is people don't have the initiative or they don't have the direction, you know, things like that. I kind of talk about security selling, you know, the 3 things that a customer must have for you to do a security deal are a budget, a mandate, and a clue in the security vendor world. And a lot of times that mandate thing is really important. You've got to have a mandate as an operator as well to, hey, do smart things with this technology that you've got, not just the bare minimum, but stuff that will give you more capability than you would necessarily have otherwise.

So this is kind of— it almost makes me think that there is new and fun network security stuff that's due to the cloud. So up to this moment, the conversation was kind of like, oh, which of the old NetSec stuff survives, how it decreases in relevance, but how it's still relevant. But what you just told us is kind of new and cool network security stuff that's actually born in the cloud and it matters in the cloud. Am I being too excited about this or is this a fair assessment? Like you started a company about this, so you better be excited about this.

I get that. Yeah, I think it's a fair assessment. Well, you know, this company exists to basically give people the ability to get their hands back around their networks, right? Because these networks, you know, we call 'em atomized networks. These networks are dispersed all over the place, right? They're in cloud or multi-cloud. They're also IT environments. A lot of big enterprises that we primarily sell to, they have OT environments as well. And trying to understand your entire deployed plant and protect it effectively without having to deploy like 4 different technologies that have the same rough capabilities, but, you know, different languages for describing good and bad and different eventing and different reporting, probably different teams that run them. That's a frickin problem. That's a big problem.

Yeah.

Because you got— you're literally constructing a Tower of Babel where you're going to have all these people that speak different languages trying to, you know, coordinate and communicate with each other. It's kind of Kafkaesque in a way. So yeah, there's big opportunities, especially in the cloud, for, you know, coming up with new approaches to be able to do these things because in a lot of cases, A, the cloud is somebody else's computer, but it's a lot of typically Linux infrastructure that needs to be defended in kind of Linuxy ways. And we've wrapped it all nicely with zero trust architectures and all the modern buzzy things, but misconfiguration is still a big problem that leads to compromise. Relying, you know, doing zero trust where all the trust is actually kind of moved out to the identity and access management platform, right? So zero trust in that now we've put all of our trust in the identity access management platform, and if that fails, then we are fucked.

We had a bit of a fight with John Kindervag over that because the trust in identity. So I don't want to go into details, but it's an interesting one that I've attacked John with this point that ultimately you do trust identity system. And he pretty violently, or rather vehemently, disagreed with that. But, and I guess the readers can go check the episode, but it's, to me, this is a good debate to have, but it's a longer debate.

You're right. Yeah. Well, you know, it's like a theory versus application debate, right? In theory, it shouldn't matter. In application, it really does.

Yes.

Yes.

The other point you made was about multi-cloud. And it's kind of a— for some people, it's a painful topic because once I was trying to ask a bunch of CISOs as whether they would ever choose multi-cloud if it were up to them. And I get a roughly 100.0% no from everybody. But if you ask them, are you multi-cloud now? Presumably most of them would say yes. So what are the new things in network security if you include the current mess of some on-prem, some multi-cloud together? Like people probably deploy applications that sort of cross boundaries from on-premise to cloud. I don't know about the cross-clouds, but what is the network security stuff that arises because of that?

Well, I mean, that's one of the kind of primary things that we've gotten into, which is trying to identify what you've got and what it's doing, right? So, we've got a very, very fundamental problem of very simply, tell me what I have and what it's doing. And we go into customer after customer where, A, they don't really know, and B, when we show them, there's, you know, to a more or less degree, there's kind of an oh crap moment of, oh geez, well, that shouldn't be there, or that shouldn't be happening, or, you know, I thought we fixed that or got rid of that or whatever. So, you have that fundamental visibility problem, and, you know, like, You know me, I've been doing this for a long, long time, and I have traditionally come up with very sophisticated technologies to deal with very sophisticated problems. But this is a very straightforward problem. What have I got?

Mm-hmm.

A lot of environments, the answer is, I'm not really very sure. And when you show them, they're like, ooh, okay, well, I guess we were right. We didn't know what we had. So you've got that problem. You've got these operational governance problems, I call them, which is the difference between how you think you're configured and what's actually happening. So what's actually happening is operational governance. And a lot of times that's not threats and attacks, it's dev and prod are talking to each other and they shouldn't be. And I thought we fixed that with CSPM and, oh geez, when the latest build came out of staging up to prod, all of a sudden they're talking to each other again and we didn't notice it for a while, right? So you've got all that kind of stuff. And then you've got kind of the fundamental, okay, well, when things really go off the rails and I suffer a compromise, how am I going to Tell? And, you know, what are the ways I have to figure it out? Do I rely solely on instrumenting the workloads or sidecarring them, or do I need kind of an external vantage point, you know, kind of the network as the informer of last resort? This thing is acting very strangely compared to how it usually acts, you know, is that sort of thing that we need to get to? In my opinion, obviously, given what I'm doing, I believe the answer is yes, you do need to be able to, you know, have those You know, that fundamental data source of last resort that is always, you know, that is what's actually happening. Can't be influenced by outsiders, you know, getting into a system and starting to delete log files and stuff like that, or whacking your EDR over the head and tying it up and leaving it in the corner.

I mean, EDR, even that implies that you have endpoints, VMs, right? You may be in the cloud, you may be in platform as a service, you may be in what cloud providers like us call managed services, or maybe in SaaS land, a bunch of this just goes out of the window and you're kind of out of luck in regards to your EDR, right? There's no E.

Yeah, well, right. So you've got that problem. You've also got, you know, in larger enterprises especially, you've got all this OT, whether it's a, you know, vending machine sitting in the building, you know, that everybody's sitting in with their laptops, or, you know, a factory floor or whatever. You've got all these things that aren't really computers that are on the networks side by side with computers, and depending on how gracefully they've laid out their network may have more or less complete access to everything in the network. So there's a lot of hairy problems here.

So before we start closing, let me ask you an easy question. And the solutions that provide this type of modern network security, do they have to be in the cloud? I think I know the answer to this one because like you're not selling appliances, I would assume, but is there any future for non-cloud-based Well, I mean, you know, there's always going to be a need for it to some degree.

Now we are a pure SaaS player. We have no software or hardware to deploy, so pure cloud. But you know, you have to have what I call a point of presence, especially in kind of the physical world if you're going to enact some of these high-level security functions, whether it's kind of NGFW, IPsec kind of things, or, you know, NDR. Well, not so much, maybe less NDR, but especially things that have to go inline. So there's only a few technologies that can actually interdict an attack when it's happening, right? Like EDR has the ability to recognize, oh, this is malware, I want to stop it right now. NGFWs and IPSs have that as well. So you have, you know, several hundred milliseconds to maybe a couple of seconds to recognize an attack and do something about it. So there is a very small set of technologies that do that. And like, they can't really do it any other way unless you instrument the heck out of the workloads and devices themselves, like you kind of would with an EDR, but with a much broader scope than what an EDR traditionally does. So all that said, yeah, I think there's going to be a need for appliances for some time to come. But the problem, you know, do we, do we get into more of an edge computing thing where you've got really smart devices that are sitting out there doing a lot? Or do we have pretty dumb devices that just get orchestrated from kind of these overarching technologies like we're building that are smarter about what's going on kind of across the entire environment and can orchestrate them essentially. But yeah, I think there's always going to be some sort of physical presence there because you just have to— at some point, it's just like a switch. Like, switches don't go away because at some point, you know, I have to get network A talking to network B, and I can do that over microwaves to an extent, but there's going to be plugs and things operating off electricity at some point.

Okay. Well, on that inevitability of the network node, I want to ask our traditional closing questions. One, do you have recommended reading? And 2, Do you have a tip to improve people's network security in the cloud?

Well, you know, I'm a CEO right now, so I've been reading CEO books. So I've been reading this book, Who, about hiring lately, which is pretty good. It's by Jeff Smart and Randy Street. So highly recommend it if you're hiring and you wanna hire better. That's a good book. So that's the one that I'm currently reading. But like, you know, CEO lifestyle at a startup is pretty thin on opportunities to read.

You're not spending your weekends reading Anna Karenina? That's not CEO lifestyle?

Not lately. Not lately.

And then one tip, please.

One tip to improve network security in the cloud.

It's okay to say buy Netography Tech. We would not hold it against you, but we'd rather you not, but you can say it.

Well, I'm not gonna say it. You know, people, you know, they've got enough to— if they wanna take a look, they should take a look off this podcast, hopefully. You know, I would concentrate— I think visibility is a problem, whether or not it's Netography delivering it. I think visibility is a fundamental problem that everybody has, and it gets the short shift because it doesn't sound exciting. It's not you know CSPM or you know whatever the the latest sexy thing is for doing cloud security. But fundamentally understanding what you've got and what it's doing, whether it's us doing it or some of the other tools that are out there for doing those sorts of things, I think that it's a real eye opener when you start seeing what's actually there and what it's actually doing, especially if you only had kind of a dim idea of.

I think that's a really good answer. We've had a lot of conversations on the show about visibility, and it's important. So I support that tip wholeheartedly. Martin, thank you so much for joining us today. Really appreciate this.

Thanks. It was good talking to you guys. Appreciate you having me on the show.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security. Security.