EP115 How to Approach Cloud in a Cloudy Way, not As Somebody Else's Computer?

Security.

Hi there, listeners. Welcome to a special episode of the Cloud Security Podcast by Google. Thank you as ever for joining us today. Your hosts here are still myself, Tim Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, our reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you're wondering what's special today, this episode is also going to be available on YouTube as a video episode, and you can check out whether Tim and Anton and our guest managed to look reasonable on video for a whole 30 minutes. If you like our content and want it delivered to you the traditional way every Monday, Please hit the subscribe button in your podcasting app choice. Finally, you can follow the show and argue with your hosts on Twitter, twitter.com/cloudsecpodcast. Anton, this was, I thought, a really interesting episode in part because we were doing it with another podcaster whose podcast you've previously been on.

Yes, correct. But I think in your intro, you kind of didn't mention the juiciest part about this episode. It was not just available on— it wouldn't be just available on video.

It was live.

It was recorded in a live video. Yes, correct. We really— okay, fine. I really wanted to experiment with videos.

You really wanted to do this. And listeners, I was the virtual equivalent of kicking and screaming about this, but I did it and I think it turned out really great.

Right. And by the way, if you expect every episode to be on video—

You will be disappointed.

You would not do it. You would be disappointed. We are sticking to the audio, but, but I think at least Should I say several times? We'll do it.

Once in a while.

We'll do the live video. Once in a while.

So this episode though, what's good about this episode? What do we talk about anyway?

This episode is actually a fun episode focused on cloud security, kind of broad pillars, broad strokes around cloud security. And to me, one of the key themes we explored is of course, when people say cloud is secure but are using it securely, what does it mean? What does it mean to use cloud securely?

That's a very good theme.

Yes. And that's important for many, many clients and many cloud users, whether it's of our cloud or others. We also touched on the critical questions about people who, security leaders who actually prefer cloud on security grounds. Kind of, I called them—

Not just Gary Haislip.

Not just Gary, yeah, exactly, from that episode. CISOs, security leaders who would prefer cloud because it's just better for them. And they do exist, absolutely. And moreover, This is kind of an important growing constituency, and we kind of explored this a little bit.

So listeners, I think there's a couple of episodes that are pretty interesting to listen alongside this one, the Seth Vargo episode from 2021, where we talk about security onions versus garlic, as well as the Michelle Chiburka episode from earlier this year, where we talk about migration pain. I think taken together, those 3 episodes paint a really interesting picture about some of the trade-offs that CISOs are thinking through when it comes to moving to cloud. And so perhaps with that and without any further ado, let's turn things over to today's guest.

Our guest today is Rafal Los, and I will just let you introduce yourself because we did it in the video. It's more fun that way. And in the description, I said it's of the Down the Security Rabbit Hole podcast fame. And I think Raf questioned this.

Oh no, he's famous. He's got like 580 episodes of a security podcast. The man is famous.

Am I famous? Or as the movie once quote goes, am I infamous?

That I think is beyond my ken to answer.

Indeed, same here, same here. So this is the topic for this is of course cloud and cloud security. And a good number of years ago, Rahal had a very fun blog post called A Little Truth About the Cloud. And when I mentioned it to him, he said, oh, that was 2020, as if it was like, Wasn't that last year? But no, that's not last year. That's 3 years ago.

Oh, God.

And so, in that post, there's some thinking and themes that kind of started this whole, you know, show on the road. And one bit is that you mentioned that you still see organizations that see cloud as kind of essentially a rented data center, kind of a— and even for 2020, it would be a little strange. But can you— do you still see that? You talk to clients, you talk to organizations, you talk to people Do you still see this? And how do you explain to security leaders that they should stop doing this? Cloud isn't a rented column. Kim is laughing demonically.

I love that you give me a nice easy intro and then like a simple question to start off with. Nice softball. All right. Well, I guess we're going to dive in. All right. So, do I still see that? I think less so, which is a good sign. Although, I've been in this gig with ExtraHop since July of last year, July 1st. In my previous role, I probably saw, which is kind of when I wrote this, if you look at the on percentage, right, I'd say 7 out of 10 at that point were using cloud as a colo somewhere else where they didn't actually have to manage the hardware anymore. Now, different type of company here, different type of customer. I'm seeing a lot of thoughtful transition to the cloud. So, I would say that the thoughtful transition to the cloud in terms of an actual— don't hate me for saying this— digital transformation of the organization is a real thing. Is there a bingo card? Are people drinking at the moment? How's this going?

That's a shot right there.

Well, at least you didn't say zero trust because, you know, somebody dared to question me on Twitter for using zero trust as a verb. What can possibly be more normal than using zero trust as a verb? Can't we all just zero trust it?

Please don't.

Okay, so fine. You're trying to say that the person was right for making fun of me because you're making cringy faces.

They were right.

At the same time.

Anton, I think in general, people making fun of you is always fun. Not just only because you're a recovering analyst, but it's just fun.

He takes it well.

Now, I have now heard cloud zero trust.

Cloud zero trust. At least it's not a blockchain zero trust. I'm okay with cloud zero trust.

How is that different than regular zero trust?

I don't make up the acronyms. I just make fun of them.

Ah, got it. Got it. Got it. You know, Anton actually makes up the acronyms. That's why he's so fun to make fun of.

Yeah, I used to. I used to like, you know, it's not my job anymore to make that up.

So a lot of people, including former analysts, have said, cloud is secure, but clients just aren't using it securely. What's your reaction to that? Is that like saying lava is safe to walk on if you wait long enough for it to cool down?

I love it. I love that so much. I'm going to use that later. That's the same thing as saying, you know, every car is safe as long as you don't get in it and drive too fast. Having seen the PowerPoints of cloud architecture and the shared services model, shared responsibility model floating around when it was first a PowerPoint slide being circulated as a concept.

Hmm.

I think what I can tell you for a fact is that in theory, the cloud is likely more secure than just probably 90-some-odd percent of the companies that go to it, their previous infrastructure. That being said, the potential entry points into that environment Could become catastrophic.

Say more about what you mean there.

Wait, yeah, I'm puzzled a little bit.

A little bit. That's not surprising. I do this to you on purpose. No, no. So think about it this way. A customer that has a single data center, one single office, lots of compute in that data center, physical servers protected by a relatively good M&M-style security model where it's how dare you shell, squishy stuff in the middle. And then you take that and say, okay, I'm gonna move a bunch of these servers, because we can't say applications yet, I'm gonna move a bunch of this compute into the Amazon, Google, Microsoft, all of those clouds at the same time. Now, is this a better situation or a worse situation? Well, I think it's better because inherently those infrastructures are much more likely to be modern Right, from a designed-for-security perspective. However, the crap they're putting in it, definitely not, right? So you took an application, a monolithic app that was never designed to defend itself or even have any concept of security because it had firewalls and WAFs and all sorts of stuff behind it. And now you stick it into the Google Cloud, and while the backend Google infrastructure takes a pretty good attempt at doing security on the whole, that application without intent, without actually intentionally engineering it to be put in that computer environment is like— I've used this analogy before and it's kind of weird, but it makes the point. Like when we were little kids and then on Halloween you'd stick your hand in a box and they'd tell you, oh, those are eyeballs. They're really wet grapes, but you don't know, right? You're sticking your hand in a box and going, eh. That is what you're doing to your compute, right, if you don't know what you're doing. And the problem is, the problem is the rate at which we're creating cloud-aware architects, application architects, and security architects, and architects in general, is I think at least an order of magnitude too small to the need that we have, which creates— To me, like, I, 2 jobs in a row, I lost lots and lots of really smart guys and gals from sales, pre-sales, engineering, all that in an MSP type of environment to Amazon because they paid, and I kid you not, 2.25 times more than I could possibly pay them. So they would get their cloud certs and poof, they're gone. I mean, that's great for them.

But it also reminds us that cloud is tricky if you don't know cloud, but if you do know cloud, you join a cloud provider. So, I think that it's kind of a vicious, or maybe virtuous if you're a cloud provider, circle when the best talent— you need talent that knows cloud, and when you train your talent in cloud, they join the cloud provider.

They go to the cloud. They secure the cloud.

That's an interesting thought.

Yeah. We've had this debate before about security onions versus security garlic. Do you see people doing at all okay at doing identity security right in the cloud, or is that just like complete alien sauce to people?

Look, I had a— I'll give you an anonymized story. I had a customer say, hey, we figured this out a couple of roles ago. We were pitching them the idea of CSPM. So this has been a couple of years. They came back and said, no, no, no, we got this all right. Like, this is all native. We don't do any legacy kind of stuff. All our identity Stuff is done. We federate, we've got the roles and permissions. And somebody reminded some— one of my pre-sales engineers reminded them there's like, I forget what the number was, like 1,000 or some crazy amount of different roles and combinations thereof. And then you heard this silence and they go, maybe a checkup would be a good idea. So I feel like In the quest to do better security, cloud was engineered with every possible option, right, to do it right. And then we hand it to the customer and go, go ahead, here is a massive box of Legos, good luck.

Right. So this is like, I kind of two-thirds agree to that.

Kind of 2/3? What does that mean, Anton?

That's Anton softening it before he tells you you're an idiot.

No, no, no, no, no. I am mostly in agreement with that. But one-third is that my sense is that if you're doing things in a true cloud-native way, you are not really using some of the bolts and nuts that are meant to make your VMs run in the cloud better. And these are usually the more, slightly more problematic pieces in terms of talent and training. But if you're doing things from scratch in a modern way, you may not be suffering from the complexity. And again, the reason why I'm doing this, by the way, is of course of the 8 Megatrends blog post by, ultimately by my boss, Phil Venables, right? And Phil makes a really good argument in that post that says that if you are using cloud in a modern way, you are actually enjoying cloud simplicity, not cloud complexity. And that's the third where I was like, yeah, but if you're doing it this way, then you're actually using cloud security and you're gaining the benefits.

You have to know that it's there to be able to use it, to take advantage of it. Like, this is—

yeah, okay.

Like, do you guys remember when we said we're going to turn on disable people from publishing S3 buckets? Because that's what every example everybody's— oh, the open S3 buckets. So Amazon went, fine, no more open S3 buckets. Every developer went, this is too hard, open S3 bucket.

Yeah.

That's how you do guardrails wrong, right? If you have guardrails that are too restrictive, everybody says, what's the polite term for, I hate you. I hate you. And we're doing it our way. Yes, this is kind of the story. But actually, here's the possibly more useful angle to this. Well, actually, this was useful. And the more useful angle, what do we even mean when we say, hey, cloud infrastructure is solid, it's epic, you're just not using it securely? And people say, agree, disagree, but nobody thinks, what does use it securely even mean? So for example, how about don't use any of the less secure migration models? Like, that's part of it, not part of it? How about—

But a bad cloud migration model, that's not something you can evaluate with software. That's not a bad firewall setting. That's so abstract.

Right, exactly. Fine. When you hear somebody says, use cloud securely, what comes up in your mind? Like, maybe we should run a classic Anton's 3 AM test. If somebody wakes you up at 3 AM and says, wake up, wake up, what do you mean by use cloud security? What would you say? What's your first reaction?

So, this is when somebody says, if somebody were to do that to me, I would immediately think of the mechanisms that are built in, the guardrails that are in the cloud itself. So doing things like turning on logging, doing things like turning on some of the default features, designing— when you talk about cloud security, it's not just a security mechanism. It's not taking a monolithic VM out of your environment, sticking it someplace else, right? It's actually potentially redesigning the thing to operate in a different model. It's looking at network security, right? So figuring out like, what's the autonomous thing that you're trying to defend and protect? And what are the capabilities sort of around that thing?

Yeah.

And far from me to say I claim expertise in all the cloud-native security tooling, but I can tell you it's not something you add on later. And the problem is that you guys remember we said, hey, you can't bolt on security later. It turns out in infrastructure, you actually probably could, and you could be about 75% successful. If you try that in the cloud, you are I'd say your odds of being successful are less than 25%. Why?

But people bring up even the packet capture appliances, hint, hint, NDR to the cloud, right? Like, I'm not— we're going to ask you a question about it. But like, isn't that an example of somebody bringing his 1990s luggage, like firewalls, and, you know, IDS, and like other stuff to the cloud, an example of that?

Anton, you got to separate the concept from the implementation. The way— I don't think there's anything wrong with saying firewalls in the cloud. I don't think there's anything wrong with saying IPS, NDR, and endpoint security in the cloud, but it's fundamentally different than what it was previously.

Endpoint security in the cloud. Well, we're going to have to pick on how we make that successful.

You can come back to that.

Yeah, it's EDR. You can't not have EDR, right? Oh wait, you don't have an endpoint. Holy cow, how would you do that?

Well, and that's the thing, right? So, you do it differently. It's not an agent that you install somewhere. How do you do endpoint security? It's by watching your VPC, by looking at individual, whatever your autonomous units are. And if that autonomous unit is a function, you have to completely rethink what is the endpoint there, right? Like, okay, it's a function, or it's a piece of code that runs once a minute to do a batch job. It's really AppSec, isn't it? Like, it's the concepts I think translate because I think, guys, the fundamental principles of security haven't changed since I got into this thing 25 years ago. You looked at, you know, the user, the infrastructure, and the data, right? And its applications. And then you're like, oh, well, we had a system, right? Via a VMS, VAX, an Acer Alto, say, you know, old Novell NetWare box.

They're not that old, by the way. VMS? Really? You don't look that old. Fine. I'll go with that.

Hey, I age gracefully. Maybe it's this beautiful Atlanta weather. No, but I vaguely recall the days of when we had a 20-megabyte hard drive that all the corporate data going back years lived on.

Tim was like, he is that old.

Tim secretly thinks to himself, he is that old.

Yeah. Okay.

That's right. I'm pretty good for 55.

All right, listeners, I'm making the silliest faces right now. I've never heard of a 20 megabyte hard drive. I've never—

and they were like shoebox size. I mean, these things, and you had to wait, you had to park the heads first, then power the device down and wait for it to stop spinning. Because if you jolted it ahead of time, it's like a scratch on the record and you're done. You're toast. It may never power back up again. Yeah, we're not going to— nostalgia is a different episode.

Not go there. Just like stop going there and come back.

Yes.

So I want to pick at this.

Let's talk about this bolt-on versus built-in thing, because I think this is really interesting. And not just because I have personally built endpoint security into the cloud. I think that's great. That's literally what one of my teams does. And it's a fascinating challenge every day. I also want to say Anton must have the world's worst alarm clock.

At 3 AM.

You know, every day Anton must get woken up by his alarm clock going, Anton, it's 3 AM. How do we secure the cloud? That's, that's got to be terrible. Right? That's surely how he lives. It's the only explanation.

It's a hypothetical question. It's like Einstein riding on a beam of light kind of thing. Not like literally somebody wakes me up at 3:00 AM, even though my 4-year-old did today. She didn't ask about the cloud security, but like, hey, separate story. Maybe in 2 years she will.

I'll tell you what, if your 4-year-old starts asking about cloud security, Anton, something's wrong.

I do want to shift gears though and talk about CISOs and clouds. You know, we had Gary on the show a couple weeks ago, and he was a pretty big fan of the cloud for really interesting reasons. Do you meet CISOs who are like active cloud security fans, people who are like, yes, we got to move to the cloud for security reasons?

I do, and I think those are the same people that recognize that the world is fundamentally changing and business has to change to be, to be competitive. And they've seen, you know, 2, 3 decades of legacy IT technical debt, and they see the cloud as a chance to wipe a lot of that out.

Ah.

Now, what they don't tell you is they're secretly praying to whatever deity they believe in that the business allows those applications and those infrastructure components to be re-engineered to be cloud native, as opposed to taking 1,000 Windows servers, making them VMware virtual machines, and sticking them in the cloud. That's not what you're hoping for.

Yeah. So it's a little bit like a deluge, and they get a Noah's Ark, and they hope not to have the Windows servers onto the ark.

Yes. Which reminds me, by the way, we really— it's like the conversation is going well, but somebody on LinkedIn pointed out in comments that he really did have one of those drives. So he's probably at least as old as Rafael, but probably way older than Tim. This is my suspicion. I'm not going to disclose my relationship to 20-megabyte hard drives, So that my age would remain a mystery. But ultimately, yes.

You know, I remember when 640K of memory was an impressive feat. Okay, we'll leave it at that. Moving on.

To summarize your response briefly, you did meet security leaders who would say, I want to go to cloud. Cloud's more secure. It's better for me. It's more, maybe easier to operationalize security. Maybe it's easier to do other things. So you've met CISOs who actually genuinely think cloud is a superior way for them.

Yes, absolutely. I've met several of them and they get excited. Like I said, they get excited about the opportunity. Where they're absolutely tenuous and terrified is in the execution, right? Because if that execution doesn't have security as a stakeholder in the redesign, if there is no redesign, as opposed to their dreams, their nightmares come true and it actually is worse. So, I feel like this is that path in the choose-your-own-adventure book where you can go to the swamp of despair, or the hills of hilarity, and you have to pick one. You can't go down the middle. And you go, all right, well, you know, the hills of hilarity sound like a great place to be. Now, is that people laughing with me or people laughing at me? I don't know. Let's try it. And so cloud to a lot of CISOs is an opportunity to say, okay, let's redo this. Let's fundamentally rethink what we're doing, why we're doing it, how we're doing it. And then let's sit down and actually design it in a modern architecture using microservices, using segmentation, using actual data security, right? I keep seeing, by the way, I keep seeing, I don't know if you guys see this, a lot of hate for Active Directory, like federated Active Directory. There's a lot of this like, oh, federated Active Directory is a thing of the past. It's a dinosaur. Use cloud native. And it's usually somebody trying to convince you that the AWS identity model is better. You guys seen a lot of that too?

Yeah, this is a fun topic. But I think that people have been scarred for life with AD. They definitely met some of those people who were scarred for life. But I don't know, and I don't have an opinion on this one, honestly, because I don't know if they were scarred for life 10 years ago and now they're wrong, or were they scarred for life 10 years ago and they're still right? Like, I don't know that.

So I think identity models, I always call this the Anna Karenina principle of clouds. Tolstoy opens, every happy family is alike. No, no, hear me out. Every happy family is alike. Every unhappy family is different in their own way. I think identity models are the unhappy families. They're all different and you need to understand the differences, but ultimately you're going to be unhappy no matter what.

So on that happy note, let me ask you a self-serving question.

Oh, never on our show.

No, so it's a you-serving question. It's not a self-serving question.

Yeah, it's a guest-serving question.

It's a guest-serving question. We have another—

I know where he's going with this.

No, no, no, I'm not going to go— What if I ask it in such a snide— You're killing me.

He's killing me.

He just wants to answer the question, Anton. Give him the question.

Okay. So the question—

Give me the question.

Wait a second. Okay. You work— we hear that you work for an NDR vendor.

You heard correctly.

NDR in the cloud is somewhat contentious. Some people think NDR in the cloud is awesome. Some people think NDR in the cloud is like so '90s. Give us your network security, NDR take in the cloud?

Like, I will tell you this, I have spoken to a couple, been here 7 months now. I've talked to those people that will tell you, that have told me that packet capture, NDR in the cloud, it's not worth the time. Look, we have VPC flow logs and look at all this good stuff we can get, we can get, you know. And my response to that is cool, but ultimately the truth and the authority on anything infrastructure lies in the content of the packet. Being unable to actually pull the packet apart, understand its intent, its full contents, whether it's hiding something, right? Because we know you can stuff things into packets that aren't supposed to be there, DNS. And I think that what you get if you implement network detection and response is a way to have a transparent— so, or not transparent, what am I looking for? You don't know that I'm watching you, right? Like I'm watching you, but you don't know I'm there because I'm watching a copy of your traffic as opposed to—

I'm not passive though. Yeah, I get it. Yeah. Not transparent or passive, but yeah.

Let me just throw the hand grenade that I've been wanting to throw at every NDR vendor for a couple of years now. What about TLS 1.3?

What about it?

When I profiled traffic on GCP, I saw 98% of traffic on 443 compared to 80. So like, what are you going to do to get the contents of packets in a 1.3 world where you can't? pop the encryption so easily.

You pop the encryption so easily. Do you remember back when forwarding proxies existed and you're like, oh, well, how are we gonna—

Yeah, but actually ExtraHop is the vendor with the tech to do it. So this, like, you really— I think Raf planted this question because literally they are the guys who invented tech to— he did not know this, but I did from Gartner days.

Oh damn, did I blunder with my question?

We are literally the only ones that have 1.3 transparent.

Literally.

Boom!

It was not meant to be a softball, listeners. I think he just pulled out a tennis racket and sent the grenade back.

No, listen, this is— by the way, we agree with you as an organization, clearly, because we spend a ton of engineering time and many brilliant minds drank a lot of coffee, or at least tea, over the question. And the answer was, you got to get in that conversation stream. That's, listen, but that's the same argument. And I don't mean to belittle what your thought process here, but that's the same conversation I had with people putting in IPS in the mid-2000s. Like, well, what if everybody just encrypts everything? I'm like, okay, then we look inside the encryption stream. Like, we have to see what's in the packets. Profiling like sFlow, NetFlow, all that stuff. Cute. Great. You can see it, but sampling doesn't work. We've seen it. We know it doesn't work. Being able to build behavioral models— and this is where I think that it's even more applicable than a lot of people think— being able to build behavioral models at scale, right? 100 gig, whatever, right? 50 gig in between VPCs, in between zones, in between wherever. Being able to watch that traffic to see exactly what's going on. And I'll tell you guys why. A long time ago, I used to work for this large global company, has 2 letters in it. I'll let you figure out which one that is. But I was a third party to an incident where they had the SIEM, they had the IPS, and it was one of the best, best ones at the time. They had the firewall infrastructure, they had done the AppSec, they had a WAF, and they had network monitoring, application monitoring, database monitoring, and all kinds of user analytics monitoring. Okay, they were in 2 separate silos. We came to know that there was a breach that happened where somebody basically backed up the Hoover vacuum to their database, pulled it all out. They're like, how could this have happened? How could none of our security tools have detected SQL injection? They're like, oh, well, blame it on the fact that it was encryption. Yes, that's it. The front-end traffic from the user to the application was encrypted.

That's the problem.

They're like, No, because you got like a bunch of suspicious events that happened. Like, well, okay, the IDS didn't catch it. The SIEM didn't catch it. It might pass our WAF. Like, what happened there? And the thing is, the security kit said, this is weird. Somebody should look at this. But like every security device that says that, that medium level, like, this is weird alert, somebody's gonna get right to that 2 days after never.

Yeah.

Right? Because that's in that stack of 10 million things they're never going to get to. Because it's not Sam Kinison screaming at them, critical! Right? And so here's the problem. If they would have switched over and looked at the network side of the stovepipe, 2 sides never talked to each other. Application performance, the CPU on the app got a bump. It got connections from someplace in the world it never had before. It had traffic at a time when nobody ever used the application before in that volume. It had the database hits, the queries per user, went exponentially up. The rows returned per query went up by like 10,000%. Like, but what did they do, right? The database team logged in, ran some checks, said, everything's fine. Weird, the problem resolved itself. But as a security person, I'm looking at it going, somebody just stole your entire database.

Right.

Why does Oracle go to 99.9% CPU? Select star. That's the only reason, or you've borked a query. But the problem is you could never see those things. I'm going to tell you our platform, and I'm sure other NDRs that don't suck if they exist besides us. Sorry, couldn't help myself.

Okay, we are charging you an ad.

Fine.

Listeners, this is the end of the Cloud Security Podcast being ad-free. Welcome to the new ads era.

Okay, yes, we are ad-free.

Yes. No, no ads here.

I apologize. But look, listen, when you look at the entire packet stream, and this is cloud or infrastructure, You can see the way things behave. And if you're looking at it from a performance perspective, that's hugely helpful. But just on our podcast, literally an hour before this one, we recorded with Sergio, formerly of Microsoft and other— Dragos, and like the threat intel guy, right? What we're trying to do in security right now, largely even in the cloud, is detect things by pattern or by artifact. So this IP address is bad, this file hash is bad, this thing should not do— what we're not looking at, at least not effectively, because we don't have the tools if you don't put NDR in place, is, well, this is an application group. These 7 things talk to each other in this profile after observing them for a period of time. And then you get this one thing that's like, that's weird, why is that thing doing that, right? And now you've got something to investigate. It's not a red beacon of like, hey, you're being attacked or hacked. It's not that smiling kitten, glitter panda, whatever the hell is attacking you.

Glitter panda. That's a new one.

Glitter panda. I'm pretty sure I'm going to look up, is there a threat actor?

Guys, this is where good security starts. When you look at something and go, hmm, that shouldn't be happening, or that doesn't look right. Because once we automate the heck out of pattern-based security, which I think we're getting close to, right? patterns-based security is kind of hitting that event horizon where the benefits are going to, you know, are going to level out and in fact probably over time start to slowly decrease. We've hit the top of that inverse hockey stick. This is where behavioral-based analysis comes in, right? When we've got actual uses for algorithms and machine learning where you can feed it tremendous amounts of network volume across your entire cloud infrastructure and your legacy infrastructure back home, right in the data center and go, okay, I see everything. Everything's great. No security alerts, but there's suddenly a web server trying to make DNS requests. That's weird.

Yeah.

I have to ask our traditional closing questions. Do you have one tip on cloud security that isn't deploy ExtraHop? And 2, any recommended reading? I'll take that one for free.

So the one tip I would say is If you're hearing— if you're a security function and you're hearing that your organization is going to make that move, if you're going to go cloud, I don't care who you have to bribe, get into the initial conversations. Because by the time you get into discussions of architecture, it's too late and you've lost.

Yeah.

And then you're back to trying to bolt things on and it sucks.

Yep, that's a good tip. I like that one a lot.

Uh, what am I reading? I'm rereading a Howard, rest his soul.

It's the '90s. What is it, 2004? What book? What year is this?

So, you're gonna laugh, but I think this is— gosh, when did he write this? 2006. Close enough.

'06, not 2004. I was almost right.

Got it. So, this is why I think something like this is important because we tend to forget the lessons that we learned back then and we tend to think that, hey, everything is new. None of the old stuff applies. Let's forget it. And it's staggering. Like, you go through some of the old, like, Hacking Exposed books, you're like, oh my God, all these things are alive and well today. We just call them something else. So part nostalgia.

So on that topic, yeah, we should probably start closing because this book is, I'm pretty sure it's going to fly off the shelves now if it's on the shelf.

Yeah, you're not— so I even got mine autographed by the man. So I'm pretty excited. I love it. I recommend if you haven't read Patrolling Cyberspace by the incomparable Howard Schmidt, Then are you even in cyber?

Okay, fine. On that note, thank you very much for being a guest on our first-ever live video session. And of course, thank you for all the setup advice, and hope to see you next time somewhere.

Somewhere. Thank you, guys. Ciao. Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and _TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.