EP141 Cloud Security Coast to Coast: From 2015 to 2023, What's Changed and What's the Same?

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button in your podcasting app of choice. You can follow the show, argue with your hosts and the rest of our Cloud Security Podcast listeners on our LinkedIn page. Anton, this is a fun CISO episode that's full of growth lessons, leadership lessons, interesting stories of migrating to cloud, and— One of the strongest endorsements of cloud as both risk reduction and business velocity improvement, I think, we've gotten on the show to date. What did you think today?

I think so too. I think that we should not lament that the episode did not cover how to improve configurations of your cloud armor or how to run SIEM or any of this. It's a really good episode with a guest who experienced some of the lessons that clients are learning today, but 8 years ago. So, it's really fascinating that It's like for many companies, his past is the future. Yes. And that makes his lessons hugely valuable.

Hugely valuable. And his advice is applicable to both CISOs all the way down to people who want to get started and get promoted in our field. And so maybe with that, let's turn things over to today's guest. With that, listeners, I'm delighted to introduce today's guest. Today we're joined by Jeremiah Kung at AppLovin. Jeremiah, thank you so much for joining us today. Excited to have you here because we have something in common. We've both had the East Coast to West Coast experience. You know, I started my career in Washington, D.C., and I swear to God, the people I worked with at the startup I worked at first, Shape, to this day, if I get drinks with them, they rip on me for wearing a suit to my interview with them. So the East Coast to West Coast interview, the whole thing is very real. So what's your take on that distinction aside from costumes for interviews?

Yeah, I totally get it. I'm not a big fan of wearing ties either. It feels like a weak pair of hands slowly strangling me all day long. Yeah, for me, it's more of a metaphorical one. I was born a West Coast surfer kind of guy for the longest time, but career-wise, especially making the moves, working for bigger banks, which I saw them as East Coast— let's face it, the bigger banks are New York, North Carolina— it's very suit and tie, very more buttoned down, very much more about the controls, the frameworks, the committees, and InfoSec has to give the go-ahead before anything goes to production. West Coast, being out here with places like Palo Alto where innovation is rampant and it's wonderful, you got to move fast. You live by the speed and the velocity of your releases. And if someone's slowing you down, they're going to keep you from getting to market faster than your competitors. So, it's a very different approach to information security. I remember earlier when I started speaking about this about a year ago, you could tell all sorts of funny stories about being at an East Coast company and, you know, all the red tape you have to go through and everyone kind of sighs and kind of agrees with that. But, you know, at the end of the day, West Coast, you have other risks you need to be aware of too as well. And it's about trying to find that balance and attending to what the risks are.

So the fundamentals don't really change, but out here you have to innovate faster?

Innovate faster. And I think really what you need to understand to have is a clarity of the risk, right? To really understand what the risk is. Coming from a big bank, of course, losing data is a huge thing— operational risk, regulatory risk— and there's all of those layers that you need to go through. With the West Coast, you really need to kind of understand, okay, how's this company making money? Where is all our data sitting? And, you know, what are all our attack surfaces? So, I think this is a basic step for anybody in information security is to really understand what the asset inventory is, including intellectual and data assets. Mm-hmm.

Mm-hmm. But it's not just small company, large company, though, because it sounds like if you are on the West Coast startup, your risk of just dying, the risk of startup going kaput, deep in my heart, I think it's more important than cybersecurity risk. I'm joking about it, but ultimately, I understand if I am a startup guy, the startup going out of business is a higher risk than security issues. Of course, security issues can also drive you out of business. Yeah, I get that. But that's not just what you're talking about, right? There are other issues.

Yeah, absolutely. Other issues on that, because the operational risk is, again, if your competitors beat you and you lose market share, okay, yeah, regulators are going to come after me or something like that, but it doesn't really matter. I'm out of business. What's the big deal there? But at the same time, if you do get breached, that's going to make you lose market share as well. So you need to kind of figure out what that balance is.

Okay. That makes sense. So let's shift gears. This was actually a kind of a cool intro and it introduced the whole concept in my mind. Now I kind of think, hi, are you East Coast CISO or West Coast CISO?

Maybe my greeting.

for the foreseeable. One other thing we wanted to explore, and this may have something to do with this cost dimension, is initially, when cloud computing, public cloud showed up, the default stance from many CISOs was kind of slightly negative, or maybe strongly negative, or get this cloud out, I'm not allowing it in my company. So, this was probably, like, a good number of years ago. Now, certainly, this changed, and we see a lot of CISOs embracing cloud, but Here's the thing. We hypothesize that there are CISOs who are active cloud fans, who kind of want cloud because it's better. And admittedly, we have a CISO here, Phil Venables, who is of that type, but he joined Google Cloud because of that belief, presumably. Now, are there other CISOs who think cloud is just superior for security, and they're driving cloud adoption as opposed to resisting it? What is your take on this?

Yeah, that's a great point. I've seen both sides of the coin. I've talked to people on both sides of the coin. On this one. And I'm kind of obviously in the more cloud-centric side, but I'm a little bit more in the middle to the left of that, if that makes any sense. I'm very pro-cloud. I think it deals with very efficiently a lot of the old concerns that you would have about security, patching updates and vuln scans and vuln updates and all that other type of stuff, because you can spin these things up so quickly, the fixes, and release it out there. It's not, not back in the old days, some guy with a CD running around from every server trying to load an update. Patches and stuff like that.

You know, that's such a funny thing to pause on because maybe this is my youth speaking. I sometimes forget that people had to do that. And I think for a lot of our listeners, it's hard to appreciate that. Yeah, really. That's how it used to work. If you had to patch something, it wasn't Terraform apply my new version. It was a dude with a CD in a server room somewhere. That's crazy.

Oh yeah.

Yeah.

And if you were in a freeze period to try to do patches, you had to go through all sorts of updates and things like that to try to get in, and it gets all sorts of approvals.

I think the dude with the CD is the least of your problems. It's talking to all the layers for making a change, submitting requests in paper forms, ITIL bureaucrats. I think the dude with the CD would be like, dude comes in, sticks the CD, and does the patching. That's fast.

No, no, no. But some of that still exists, right? You still need change windows. You still need approvals. So maybe here's a question is, how does Check Cloud for you as a CISO change that part of the equation? What's the non-technical difference?

Improved, improved, not changed. Take this pessimistic stuff out. How did cloud improve this for you?

Anton, I think that's known as leading the witness.

Okay, fine. Yeah, I feel like you're trying to give me what the answer is there, but I mean, the thing is, I'm already on that side. It's really the visibility. As you know, being at AppLovin, we're strong partners with Google Cloud, and being all in Google Cloud, I can really see where our assets are. I could see trends over time. I could see the logging and the monitoring and all the alerts and the phones all in one spot, which is very nice. But I get it, not every company can be 100% in the cloud. I would imagine at a bank, you're going to at best be at some kind of hybrid approach to that, depending on the size of the bank. And I could see and outsource a lot of the running around changing— I just had this question the other day dealing with some audits. Hey, show me when's the last time you changed and rotated your keys and how often that is. Well, Being in Google Cloud, they do that for you. And you guys do a random rotation of that, whereas I think AWS does it to make sure the keys are rotated every 365 days according to NIST and FIPS standards. You guys do a random rotation, which it could be 2 weeks, it could be 365 days, but at some point those keys will be rotated. So that's kind of the intelligence behind to keep it random, to keep it fresh, to keep it on top. I appreciate that from a security perspective. And I don't have to rely on a team to constantly run— again, running it out and changing keys and this and that. Even at a cloud level where you have to, you know, you can just turn terminal in and do that. This is just handled for you. And as we moved more and more to Kubernetes, more and more to serverless environments, these old ways of needing to do security become less and less impactful. But then again, there's always a new attack surface that has yet to be discovered. New problems are going to come and show and raise their heads from a security perspective. We're just on the way of discovering what those are.

Yeah, that makes a lot of sense. So I want to go back in time a little bit to maybe when cloud was newer for you. I understand you were part of some big migrations back in the day. What did you learn about doing those, quote unquote, right?

I was really lucky to be with Capital One, 2015, '16 sometime, when they were deciding to be the first big bank to move everything 100% into the cloud.

Famously cloud forward.

Yeah, very cloud forward.

Yeah, so how did that go?

It was a lot of sleepless nights, a lot of work, but it was really interesting. It was great to be part of that team to really learn. How cloud can mitigate, how to move quickly, how to combine the teams. I think one of the things that I found to be the right way of doing things was they took a very strong 2-in-the-box approach, really kind of a 3-in-the-box approach. And what they mean by that is for those teams to move forward, the development team would have one lead that was the business lead and say, hey, this is what the customers want. This is what the industry and market trends are looking at. And then there would be a tech lead say, okay, this is what the teams can develop and how long it's going to take. And then I kind of squeezed my way in there to become that 3 in the box, the security perspective, to listen, okay, this is what the business wants, this is what tech can provide, and here's the risk and the risk we need to mitigate. And to have that conversation was invaluable because you got it from every angle. You didn't just hear what IT said, that I can only do so much and why is the business wanting that? You got to hear it from the business, exactly what they wanted, how they wanted to do things, and why too, and why this was important for the business.

That makes a ton of sense. So, what were maybe some, for people in a similar boat in the future, how did you get effective at communicating the risk to people? How did you help business understand that? How did you help IT understand that?

What was it, the saying that they say, fools talk, cowards stay silent, wise people listen. And that was really kind of key for me on that one was at first listening to the business, understanding their pains, understanding what they were challenged with. This really helped me to assess my risk and also come up with mitigation plans that would work for the business. Again, same approach with IT is understanding, okay, what are their pains? Where are they coming from? And this way, I can come up with what the plans should look like with considerations for everybody across the board.

Okay, so—

wait, wait, wait. Sorry, Tim. I'm kind of curious about it, but like, I'm nervous that we are kind of reducing all this to effective communication only. Is this Sorry, this doesn't sound very right, but the point is that effective communication clearly had a huge role. But were there other pillars for success? Because a huge migration of the first half of a bank to the cloud had other tricky elements, right?

Yes, that was another one. What we had was a very strong partnership with our cloud partners at the time. They had been sitting and working with us, especially since there were no frameworks, there was no really references. I remember even the regulators at the time were saying, okay, that's great, you guys are doing that. Can we just sit and listen to see what you guys are doing so we can kind of spread this out with the rest other banks and standards out there. I think the key partnerships with your vendor, your cloud vendor specifically, was invaluable, providing advice and having that back-and-forth feeds. I remember working with one particular tool. We said, hey, this encryption standard is not really up to snuff. Could you guys work on that and develop something? And sure enough, I think within 2 or 3 dev cycles, they had something that was what we needed. To this day, I find that to be an ideal approach working with my cloud vendors or just any vendors that I have. I appreciate those who will sit down, Listen to me and hear my complaints and do the whole listening and coming up with an approach. I think almost all my security vendors I'm using, as well as the cloud vendors with you guys, have that type of approach. Hmm.

Okay. That does sound like real magic for a lot of more technically minded leaders I've met. So, this is solid. This advice is worth the price of podcast alone, in my mind. So, to sort of progress further, like you mentioned that you learned those lessons quite some time ago, and many companies are still learning them. even now, and for some of them, cloud is the future, funny enough. So, now that you've went through all this and other lessons, how are you approaching securing cloud differently, given the lessons? Like, what are you doing better in 2023 regarding securing cloud compared to the original lessons?

For me personally, it's a little bit different. Talking to some of my peers who still haven't made that jump, they seem to have that lack of trust of having their data sit somewhere not on a server that they're under control over at some point and in their own personalized data center that they have their own physical security, own the HVAC systems and all other type of stuff. They want to have that data. Okay. That's an approach. It's going to be tough to scale over time. I think one of the things that I found to be very successful here that's helped me is reading a lot, a lot of reading, a lot of talking to other peers in the industries and a lot of vendors going to these discussions. To stay on top of what the recent threat is and what the other trends are and what the solutions are out there. I think that's key. We're a community and that has to be pushed forward, if that makes any sense, to continue to talk to folks. I think sitting in your own little silo is not going to work very well. Well, I don't think, I know. Yeah.

I forget who it was on the show, but they said that security is a team sport.

Yep, absolutely.

So I guess on that thread, actually, I want to pull on this a little more. I often joke with CISOs on the show that What they need is not another piece of technology, but rather a family therapist to help their relationships with other teams. What advice would you give to other CISOs, security leaders on, first, building better relationships with other teams, and 2, how to get out of the saying no mentality and into that real collaborative listening mode?

Yeah, that saying no mentality. I've talked to some CISOs like that who said, yeah, I'm looking to hire and I need people to join my team because I need them to get out there and say no as much as humanly possible.

No, people don't actually Explicitly said that?

Oh, wow.

Yeah.

And I just remember I stopped and I looked at him and I said, how you doing, man? Are you doing okay?

Wow.

I can't imagine. His life was pretty miserable. Hey, maybe if you're working on a highly top-secret government project where you got to hide the alien bodies, maybe.

That's a good example.

Yikes.

Yeah, I think a family therapist is a great way to do that, to work with our teams. But I think really, at the end of the day, it's not that hard. Everyone wants to do a good job when they come to work, hopefully, and everyone wants to get along. along with their workmates. So, I think the thing is, is the key is to be available for them.

Hmm.

If they have questions, try to initiate those conversations and also learn when to back off. Everyone's busy. They have a lot of their own success metrics they have to shoot for. So, if you could be part of that formula, great on a day-to-day basis. But if they're a little too busy for you, come back at a better time. Pizza and beer is always a good way to go as well. But I think it's just trying to be as value-add as possible. at all times, and be understanding that everyone's trying to get their jobs done as well. I think that's key.

That's good advice, not just for security leaders, but for PMs as well. One of my favorite pieces of advice for PMs I ever heard was framed as, bring the donuts. And I think security is kind of this way too. With PMs, nobody invited you, and they can get along just fine without you for the most part. So, you've got to really understand where they're coming from and what value you're bringing to the equation, If you want people to work with you constructively.

Yeah, it's knowing your role. I mean, security can be a value add and can be positive for the business, but a majority of the time we're kind of a cost to that business, right? A necessary cost and maybe hopefully a helpful business benefiting cost, but at a cost nonetheless. People aren't usually going to go to the company for how secure it is, especially on the West Coast. It's about how much money or how handy their product is first. And security's kind of a second thought, but we can definitely work together on that.

Yeah. I have heard some pretty inspiring stories on this show and in my professional life of how security helps teams move faster by taking, say, risk outta the equation or automating away some risk. And so I think maybe in cloud, due to its nature, there's unique opportunities for security teams to be helpful there.

Oh yeah, absolutely. Usually if you're already moving into the cloud, you're kind of taking a fresh start, and that's where you can really do the security by design. I get it. If you're on mainframes and you've been around for 30 years and now you're their new security person, it's really the goal back and difficult to do security by design from the start, right? You're kind of retroactively trying to find fits here or there. But starting fresh into the cloud, it's like, okay, we could do this by design. AppLovin's been great about kind of doing that with protecting their data by saying, hey, I don't need a lot of sensitive data. We're going to try to use our own attribution formats and other types of formulas to grow our customers' business without taking on a lot of that sensitive information. So that helps reduce the risk Again, secure by design.

So, this is good, essentially excellent. Okay, Tim, you can make fun of me for saying excellent, but this is excellent. However, excellence hasn't spread uniformly, right? And you do see people who are still in the same no mentality. And regarding architecture, we do see a lot of people still stuck essentially in the '90s regarding architecture. They want to lift and shift, or they're even debating whether this new cloud thing is for them. So, given your experience, what's your best advice for the leaders of these organizations where either the CISO is blocking Maybe even CIO doesn't want it. So, basically, they are not getting any of the benefits. And when they start doing cloud, they do it in a very on-premises way, the lift-and-shift way.

Yeah, that's a tough one because you're really trying to tell somebody to change their entire point of view of how they do things.

Yes, that's exactly right.

Yeah, you need to have that aha moment, travel to Damascus moment for them. And I don't think I could give them individual advice to have that aha moment other than Travel the world, talk to folks, and experience and see what else is out there. I know for AppLovin, when we jumped over 100% into the cloud, our business just naturally spiked because of the efficiencies of how quickly automating compute usage was with that intelligence to go up and down for what our demands were.

That's amazing.

Yeah. And again, that's with a strong partnership with Google on that, having just an incredible team that really kind of jumped to everything that we needed, which was fantastic. not easy to find in industries all over the world. So that was really helpful. But I think they need to talk to people who have those success stories and just to see what it is. I think at the end of the day, if those folks would talk to the business more and to see what the business needs, they'll kind of start to see, yeah, that it makes sense. It's where we need to kind of move towards. But that has to be that personality of, I got to get out of my silo. I got to talk to people out of my comfort zone. Because you may not be a business person. You could be a genius InfoSec person. But if you don't get the business and have that background, It's going to be difficult to travel far.

Yeah, that's for sure true. It reminds me of that saying, if you want to go fast, go alone. If you want to go far, go together.

Yeah.

You really can't go far in security unless you can bring other people on board. And that's one of the things we've talked about on another show, I think a CISO episode, talking about the challenge of developing people who've excelled for their technical skills as they rise in their career to then excel on non-technical skills. What advice do you have for those people to make that leap from, I'm great because I can understand X.509, to, I'm great because I can convince the person down the hall that our interests actually are aligned?

Yeah, that's a great point. So, even on my own team right now, I have people who are very smart, very technically have done some great things, and they want to get to that next level. So, for me, to that level, to try to help coach them along those lines, I recommend understanding all the different domains. And then having a very strong relationship with the business and spend time with them. I think peer mentorships and things like that to do exchange programs within the company are also very important to understand how the business works and just spending time with them. I think that's, I guess it's almost like what a social CISO type of approach.

Yeah.

It's just very social and it's really about getting outside of your shell and understanding everyone else's pains and what their goals are to win for their game. That's really kind of at the end of the day, yes, technical, that's good. You need that. Absolutely. But it's all about people, processes, and tools. It's a 3-legged chair, right? So people are so key. And I think I find a lot of the really, really smart InfoSec folks tend to focus on the tools and everyone ignores processes, right? No one wants to document anything, but that's also very important too. So those are kind of key aspects. Hmm.

But this sounds like, this sounds like hard work.

It can be, but it's really depending on your personality types. But, it's really not too hard. There's a lot of great classes out there to kind of coach yourself through and just the ways of thinking about stuff, which is good. I read this great book called Superforecasting, which was Phil Tetlock wrote this, and it was really about a way of how to think of things differently. You don't have to be highly educated. There was these experiments that they use folks to become superforecasters. And, some of the best performers, one of them was a housewife who just had a high school education would be Because once she learned how to use the little levers and stuff to do the math on this, it became about how did she see things and how she thought about things. And, it was about, okay, most people would see an event and automatically change their opinion about something broadly. For her, it was about, okay, that changes my opinion a little bit towards this direction. And then, she would gather more and more data and each time it would move the dial to the left or to the right. And eventually, she was able to call out, yeah, in 6 months, this is going to happen. And she was right. I think it was close to 87% at the time. People like that had that kind of approach is, uh, it was really helpful. And I think again, that kind of breaks down from what we're talking about today is about seeing the trends and kind of seeing the forest for the trees and then looking at every piece of information and don't just stick to one piece of information, which might be legitimate, but have that kind of shade your whole approach. You got to see all sorts of factors to kind of come in and see at the end of the day. And I think if you do that, you're going to see that cloud's going to be, for most cases, not all. Again, if you're hiding UFO bodies, okay, maybe not. We'll see that it's an advantage.

Well, Jeremiah, I hate to do this on such a note, but I have to ask you our traditional closing questions.

Sure.

First, do you have a tip to help people improve their security when migrating to cloud? And 2, aside from Superforecasting, which sounds great, do you have recommended reading for our listeners?

Yes. Superforecasting was a great one. I read another great one recently called American Generalship. I'm just about finishing it up right now. It's pretty good. It's an ideal of how to become a stronger leader and a stronger follower at the same time too. This kind of helps you coach of, okay, this is how I can mentor somebody and this is also how to be a good mentee at the end of the day. It also has a lot of really great military stories in the background on that too. So, fun stuff there if you're a fan of the military. And I'm sorry, what was the other question?

One tip, one easy-to-follow tip for people.

Yeah, I'd say try to make a new friend inside the business. At least, you know, once a month, have these one-on-ones and have a cup of coffee. I think it goes a long way. I remember getting on an airplane ride home from one of these other team events, talking to— sat down with 2 folks that I don't normally work with and got to spend 5 hours instead of, you know, watching a stupid movie, sitting there and talking about their business and what they're seeing. Talks of AI and how they're using Copilot and ChatGPT and all that other type of stuff. It was really fascinating to hear. their point of view of what they saw from a line of business that I, you know, I didn't normally do a lot of work in.

That's a fascinating answer and fits with the theme of the episode, which I think might be, listeners, go make some new friends.

Yeah.

And so with that, Jeremiah, thank you so much for joining us today.

Thanks, guys. Really appreciate it.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security. Security.