EP142 Cloud Security Podcast Ask Me Anything #AMA 2023

Security.

Hi there. Welcome to a special episode of the Cloud Security Podcast by Google. Thank you for having joined us so far on our journey. I'm not your host today. Today, Stephanie Wong is going to join us as a host, and Anton and I join as the guests. This is our AMA episode where we answer the most requested questions from our listeners. You can find this show and subscribe to it wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. This originally streamed as a livestream on LinkedIn. And so if you want to catch our other live episodes, which we're doing about one a month now, listeners, follow the show and look out for invites to our upcoming livestreams. Anton, we had never done an AMA before. You came into it with some amount of AMA envy. And I think we got through it and had a fantastic time talking about, well, just all kinds of stuff, really.

It's a really good episode. And yes, I started with a level of AMA. It's not the fear of AMA. Let's psychoanalyze it quickly. It was more like AMA envy, because apparently I've seen some people who do AMAs very easily, and I felt like we should be in that group of people, and we were not. But we ended up with a really, really fun episode. So, It's almost like I regret nothing.

Do you think that that envy or that fear maybe ties into the conversation we have later in the episode about fame and wanting to be more famous than we are? Do you think those are related?

I suspect you're right. Hence, I'm— we're doing this. You play the role of a therapist, and I play the role of somebody who needs to be psychoanalyzed because he's so obsessed about—

Lie down on my couch.

Exactly.

Well, listeners, with that and me, I can't think of a career I'm less suited to than therapist. Let's turn things over, not to today's guest, but to today's host, Stephanie Walker.

Hey, this is Stephanie Wong. I am now a product manager for our Duet AI product at Google Cloud. Previously, I did a ton of content for Google Cloud, so you might have seen some of my videos or the GCP podcast in the past. And so I've worked with Anton and Timothy quite a bit on security and other topics for videos and podcasts and whatnot. So it's great to be here today.

All right, well, why don't we get into it?

Yeah, let's do it. So, we've had a great number of questions from our community here. So, I think let's start out by talking about the genesis and the backstory, because I think a lot of people are curious about this. Tim and Anton, neither of you has a, let's say, traditional security degree or a traditional path into this field. So, could you tell us how you ended up in security? And this question comes from Louis.

I graduated from college with a political science degree, but I took classes in 18 different departments and spent time as a head TA in the CS department at Brown. And I really fell in love with the intersection of computers and state security. And so my first role out of college was at a think tank in DC where I worked on cyber policy. In DC, I happened to be the most technical guy in the room. Then I came to Silicon Valley where I got to be the least technical guy in the room. And I just sort of one way or another bullied my way into product management. And I've been doing it for the past, gosh, 8 years now, which seems really hard to believe. But it was definitely not a traditional, I got an MBA, I got a CS degree, I got an APM internship at Google. I think for me it was, this area is really interesting and it fills a niche for me. Anton actually has a weirder background than I do though.

Well, not really, because when I was kind of starting with this whole cybersecurity thing, it used to not be called cybersecurity, obviously, I don't think there were that many many people with cyber degrees. In fact, cyber wasn't even a thing. Not to say that I'm old, I'm really not, but at the time, maybe there was no normal way to get into cybersecurity. Maybe being a system admin was normal, and I kind of part-timed as a system admin while doing my physics degree. Yes, physics. And ultimately, I realized I like computers a lot more than what they compute. So, I ended up— and obviously, at the time, a lot of computers were being hacked, compromised. And I know the term script kiddie probably would age me to about 20 years ago. At the time, it was really cool. And so, seeing how computers are compromised made me quite a lot more excited than what they compute. I always was excited by the defense side. That makes me a weirdo in the modern computer security circles or cybersecurity circles because people made this impression that everybody cool is either a pentester or red teamer or came from the dark side, and I'm not. And I was always excited by building better, more effective defenses, and that's what's fun for me.

Wow.

Yeah.

I mean, I don't think there is a traditional path these days, and especially in security, right? Especially when it was just getting started as a field. I didn't graduate with a traditional degree, so I totally understand where you're coming from, Timothy. And Anton, your background is, is just fascinating as well. So, when it comes to the podcast now, of course, this is called the Cloud Security Podcast, And you're clearly not just security nerds at this point, but full-on cloud security people. So, what was the moment that you realized that cloud security was different from regular security? And this question comes from Jay, and I think it's a good question.

So, let me try first, because this is one of those rare cases when I actually prepared notes, which is something I kind of never do, because I actually tried to think back through some years and like, when was my epiphany moment? So, I was at Gartner around 2012, and I had this strange idea of writing a paper about monitoring cloud for security. And I didn't really know cloud all that much. So, I started doing the traditional Gartner thing, namely asking clients. And by the way, if you naively think the traditional Gartner thing is asking vendors, you'd be wrong. The traditional thing is asking clients, clients, end users. And what I've learned is a lot of end users that focused on securing their clouds are approaching it the same way as they would approach a data center. And the architectures that were emerging in the data streams into our research was that a lot of them pretty much did what they did for on-premise. And I started thinking, but wait a second, here it doesn't quite fit. Here are their challenges. Here, it's not the same. And I kind of started being surprised and slightly shocked about the fact that in 2012, a lot of companies were approaching cloud as kind of a rented data center, while the differences between cloud and the rented data center, they're very visible. And so, that was my moment of like, why are they doing it? Why are they all just replicating what they were doing? There are differences here. Think of the licensing model. Think of IP being meaningless. Think of some other 2012 thing that's different about cloud. And that was my moment when I was like, something's going on here. Why are they treating cloud as not a cloud? And then only later, I learned this whole Stupid sticker of cloud is just somebody else's computer. And Tim is making this slightly angry, slightly cringy face in case this is—

The cringiest phrase.

Because we now really fight this and we always say cloud is not just somebody else's computer. Like the not just thing is kind of where I— sorry, I should stop rambling, but that was the moment.

I couldn't agree more, Anton. For me, I grew up at a startup that wanted to do security very differently than how everybody else had approached the problem of what we were solving back then. And for me, it was really my education in security as an industry was do it differently. And so when Google reached out to me about this role that I have been in for the last 5 years now, I saw it as this opportunity to do what I had done there and do it here at greater scale. And so for me, I don't think there ever was maybe an opportunity for cloud security to be the same for me. When I've looked at the problems we've tried to solve in SCC with threat detection, I've always said, well, we're Security Command Center for cloud. And so I've always treated cloud as its own thing. And I think maybe now that I've been here for so long, it's actually kind of hard for me to think about security the traditional way or the regular way. And this occasionally causes tension for me with some of my Google colleagues when they're like, well, why don't you use an IPS or an EDR? And I'm like—

But if we give you a screwdriver, can you rack an appliance?

I actually have a pretty cool home network at home. So yes, I could rack an appliance. There you have it.

Suddenly you're an on-prem security expert now. You can rack an appliance.

Oh my God. If that qualifies me as an on-prem security expert, we are in deep doo-doo.

Well, I feel like I was born in the cloud era. And so I feel like from what I've learned, because I've had to retroactively learn concepts that apply to on-prem, so I kind of did it backwards in a sense, but do you feel like you can still apply a lot of similar defense philosophies to on-prem and the cloud, but obviously highlighting some differences as well?

I think that's really true. Like, I always joke with users that MITRE might not change very much when you come to cloud, at least as far as the tactics are concerned. The techniques and procedures you use to achieve an objective, those are totally different in cloud. But if you can reason about the difference between initial access versus persistence versus data exfil, and you can do threat modeling, you can do threat modeling in a lot of different environments. And so I think the core fundamental, like, philosophical underpinnings of security really don't change that much. But the difference between defending a GCP IAM policy against persistence and theft of credentials is pretty different than defending like an on-prem RADIUS system or AD.

So, this question is giving me a slight headache, but it's not a headache of like, get away, you're annoying, but more like some thinking of like, actually, there are lessons we learned at CloudSec that you can try to port to modern on-premise environments. But I think modern being a keyword because I've seen people who learn automation in cloudsec, and then they try to apply some of the ideas to modernizing the data center they have. And it kind of sort of works out as long as IT around them is modern. Because if you are trying to use the thinking and the principles from the truly 2020-style cloud environment to a 1990s data center, I think it would be mostly not a match. In fact, for a few weeks, I've been agonizing over a blog which would define the cloud-style security. We say, hey, you should do security in the cloud the cloudy way, but we never quite explain what are the main pillars for doing security the cloudy way. So, this is kind of my, I guess, public commitment to finish the freaking thing because that comes up a lot. But I think some of the lessons would apply to modern on-premise environments.

Yeah, that's a good caveat. And I think from, like, a 100-foot point of view, because I've been to a data center, I can say that there is the whole defense-in-depth layers that you can apply both on-premise and in the cloud. But when you zoom in and how you implement those policies, they're obviously very different.

I am eternally jealous that you've been to a data center. That is so cool. Like a Google one specifically.

Didn't you do like these amazing videos, like a movie about data centers? This was one of Stephanie's projects, right?

Yeah, exactly. And that's like still one of my favorite things I've done here. You just need to make a proposal for the podcast, send it to the VP of data centers, and try to get in that way.

That's a great idea. We should do that.

Yes. So we have more questions to get through. The next one is from Samuel, and he's referring to how Anton is always asking about this 3 AM test. So where did this concept come from?

Actually, it comes from SOC, Security Operations Center.

No, no, no, no, it doesn't.

It totally does.

It comes— I know exactly where it comes from. It comes from a Presidential campaign advertisement.

What?

Yeah, yeah. Hillary ran an ad back when Hillary Clinton ran against Donald Trump about a phone ringing at 3 AM and how she was the more qualified candidate to answer the phone when it rang in the White House at 3 AM. And I'm sure this is where you got it from because both you and the ad say 3 AM.

What year is this? '16?

Well, it would have been 2016 when that election was happening.

Hmm, yeah.

Now I have to go look for evidence that I've used it before, which I may find in some old blog. And if I find it, then you would be convinced that it's not— oh, that they stole an idea from me rather than the other way around. Ah, yes.

It is entirely possible a presidential candidate stole an idea from Anton.

But on a slightly more serious note, it had to do with designing alerts and signals for security because I kind of said, well, somebody says, yeah, we're going to write a rule. We're going to do detection. We're going to do this thing. We're going to match threat intel to firewall logs or do some other stupid thing. But does it pass the 3:00 AM test? And they say, huh? What do you mean? I say, if this detection artifact, if this piece of detection content triggers, would you want to wake people at 3:00 AM over that? And in many cases, the result is kind of a sheepish smile and saying, well, this alert is kind of more of an informational, and we're like, maybe you should look at it in the morning, maybe even end of the month. And I'm like, then it's not an alert. And our recent episode with SREs, right, when they kind of said, Alerts really should be alerts. If you're alerting a human, human time is needed. Human needs to be brought up to watch this, to look at this, and human has to have all the context. And to me, this is a good test. If you are seeing this, do you want to wake up a human at 3:00 AM? Give him all the info and human will be able to act, and it's the best and the right way to act. If alerts are not like that, they're sort of second-class alerts.

Good rule of thumb, 3:00 AM test. All right. The next topic I want to move into is about the podcast itself and not just the source of your questions, but Traxler asks how you both source topics for the Cloud Security Podcast.

Yeah, it's a good question. I think—

I wish I knew.

Yeah, no, it's kind of like, where do ideas come from? I asked somebody that once, like, where did you get this idea? And he just looks at me and goes, where do ideas come from? I was like, hmm, that's not an answer. In our case, I think it comes from a couple of places. Sometimes we meet somebody and we're like, wow, you're really cool. We got to have you on the podcast. Other times we think, wow, that thing that's getting launched soon is really cool. We got to have that on the podcast. Our first guest ever, Nellie Porter, we had on the podcast because I think the world of her as a product leader and wanted an opportunity to hear about what she was working on and where she was going. I think other times we get requests from people. So listeners, if you have topics you want to see us cover or talk about, let us know in the comments or the LinkedIn or the Twitters. Anton, you often just invite your friends to the show, it seems like.

Not Yeah. Yeah, that's why there's a bias in favor of detection response, right? At least like we have a cloud security podcast. We don't have a SOC podcast or detection podcast, but we do bias in favor of detection response. But these are also your friends, at least some of them. So almost like—

That's true.

We do have a bias in favor of SOC, DNR, threat intel topics, but I think we also have a bias in favor of what Google does, right? So we may not have an episode about I don't know. Let's just beat on the same topic, firewall appliances, because we're just like having trouble getting excited about firewall appliances. Are you excited about firewall appliances?

No, I fell asleep when you said it.

Yeah, exactly. So sometimes it's biased by what Google does, but I think there's also a secret third component. Some of the episodes are not idea-centric or topic-centric. They're guest-centric. We actually invite somebody we want to have on a show and basically say, hey, what do you want to talk about? And whatever they say, we usually heavily filter, censor, modify 15 ways, and then do it. Okay, fine. It sounds a little more cruel.

Anton's joking about the censorship, listeners. I don't know if there's something— so my best friend is allergic to peanuts. He's less allergic to peanuts than Anton is to censorship.

Yes. Well, there's that. Yes, I am. Yes. But ultimately, we work with a guest to present their topic because we like the guests. We trust them to be on the show with whatever they want. And these are guest-centric episodes, not topic-centric episodes.

And occasionally, listeners, we will do an episode that ends up just being a therapy session for a guest, like the episode we did on XDR.

Oh, God. Jesus. Yes. This XDR episode. Remember, we went through all the titles for this episode and we We finally managed to distill the number of curse words in the title to like 3. And then somebody said, we're not doing it. And then we used a mellow title, like, yeah, mellow. I don't know. I don't recall it, but it was, but that's why I don't recall it.

It's a mix of art and science. It sounds like the main thing is you want to have fun and you want to talk about things that you actually want to focus on and not anything outside of that.

Or have people we want, or have people we want. It's not always topic. Yes.

The people are centered.

People are so centered to it. And I think maybe Maybe we don't say thank you to our guests enough. I want to say thank you to our guests because Anton and I, in terms of prep for episodes, we agree on questions, we do maybe a little research on an area, but honestly, the show has content that's valuable and meaningful because we have guests who are experts, not because Anton and I know anything about anything.

But we do, though, right?

Do we?

Yeah, we do, I think.

Okay, if you say so.

I mean, as a person with big ego, I have to correct you and say, yeah, we actually do know it.

All right, Anton knows things.

This is why this show works. It's because you have this banter between both of you. So, the next question comes from a lot of people, actually, and they want to know what advice you would give to folks who are interested in getting into security.

Before you go there, on LinkedIn, I'm seeing live questions which pretty much all focus on this topic.

Yeah.

How do I become a PM and CISO and security role at Google? How do I get into cybersecurity? So, funny enough, I'm looking at the LinkedIn questions and I'm looking at the Questions of that sort. There are also a couple of other fun questions.

So I think there's a lot of parts of security, and depending on what kinds of things you enjoy doing, there's lots of opportunities to go into different parts of security. And so I think maybe the best thing to do to figure out how do I get into security is to figure out what makes you happy in your day-to-day responsibility. Do you enjoy the drama and excitement of, say, working in a SOC, or are you not able to stomach the toil and tedium of also working in a SOC? Do you enjoy cross-functional work like working in vulnerability response? Do you enjoy policy work like working in GRC? There's so many different areas of security that it's kind of a hard question to answer specifically, but broadly, it's important to figure out what you like to do and figure out how that matches with the different responsibilities in security. We've had different answers on the show from different people about what are the most important skills to have in security. Or in cloud security in specifics. One of the ones that has stuck with me, I forget who it was, it was somebody pretty recently, maybe it was our CISO friend from North Carolina, said scripting is the most valuable skill to have as a cloud security person. And I think that makes a lot of sense, especially in the context of cloud where everything is API-driven. So I think if I were to give like figuring your path advice, it would be figure out what you love and how to match against that. And then for skills, it would be like figure out scripting, learn the basics of networking, It's hard to learn identity as a field, but you can learn about networking, and that's a good foundation for reasoning about other things as well.

I don't want to just double down on do what you love because I think that occasionally does go off the rails. But I think that to me, the cybersecurity, whether it's cloud security, whether it's cybersecurity at Google, does hinge a lot on curiosity. And I want to endlessly quote Dan Gear, who kind of said that security, in his opinion, is the most intellectually stimulating intellectually challenging profession on the planet. I feel like to succeed in that type of profession, you do need this kind of endless curiosity. And it may be, you may back it by system admin skills, by coding skills, by scripting skills. Yes, you would need all that. And obviously today, I probably would not say that you need to have some form of sysadmin experience. In fact, you don't even need some technical experience nowadays because there are some areas of security. Okay, that advice I still frankly won't give. I do think you need technical knowledge in some amount. I am sorry. I think if you're just doing paper security, you're probably doing it wrong.

But you also probably don't need today to be able to understand the core of how Linux works. Like, that's probably not necessary. And you can get started in a lot of areas with enough thin knowledge and a willingness to learn as you go. I certainly didn't know anything about Kubernetes when I picked up the Kubernetes Threat Detection team. And now I know quite a bit about Kubernetes because I was curious and got into the weeds.

Yes, but this advice probably sounds like it was given by other people, but maybe we put emphasis in our unique way. I think that curiosity, this type of curious approach to things, whether it's technical or policy or threat actors, you can be a really good threat intelligence analyst, as many of our Mandiant colleagues are. They're technical, but ultimately many of them are threat people. They know the bad guy. They may not know what's inside the Linux kernel, But they know what's inside the mind of the bad guy. And that to me is a really good security skill, which you probably wouldn't pick up from a technical school.

Yeah, that's true. But I think what's interesting is the skills kind of come together, like the things intersect enough, and if you pay attention and are curious in life, it'll come together for you.

I think we can all say the same about our own careers and how we ended up here. I was not technical either in school, but it was the curiosity and the willingness to learn That allowed me to find more focus areas throughout my career. We do have a follow-up question kind of related to this from Brandon in the livestream. He's thinking about doing a master's after graduating. Do you think it would be beneficial to do a master's in cybersecurity or something more like an MBA, or more valuable to go into the workforce without a master's? Hmm.

I have a strong opinion here.

Oh, you do?

I do.

Okay, go.

I think you should get to it. I would work for a year or 2 or 3 and then decide whether you want more school. I spent a lot of time in my early 20s thinking about whether I should get an MBA. I ultimately decided not to because the things that it would have unlocked for me, I was able to access through like hard work and paying attention in the office and staying late and doing the job. And so I didn't end up needing to take on the mountain of debt that going to Stanford would have cost. I didn't spend 2 years not earning. I didn't spend 2 years outside of the labor pool. I spent all that time learning as I went and picking up what I needed through, like I said, that curiosity and the bringing together of skills. So my advice is always a bachelor's degree is great. Go work for a little while and then decide if you want to take more time in school. But you should figure out if you like the industry even before you go get more specialized education in it. I think that's another important thing to keep in mind there. Maybe you'll find you hate security. There's lots of reasons to hate it.

Yeah, admittedly that's true. And I think I would give a milder version of the same advice that I wouldn't automatically assume that you absolutely must have a master's degree to succeed. I mean, looking at the discussions that I've seen many times in the industry, people question the value of a degree in general, and I think that there are decent arguments in favor of it. My impression is that your life would be easier if you have some form of degree. I mean, nowadays you can get a degree in cybersecurity. So while you can succeed without a degree, you can succeed with a degree in liberal arts, in physics, in political science. or without a degree. Absolutely true. And absolutely, there are excellent professionals with great experience and huge achievements who are in all those buckets. Today, I would probably get a cybersecurity degree of some form. Not a master's maybe, but like you have a chance. Like I didn't have the chance. Tim probably didn't have the chance.

Not really.

Today, people have a chance of going and getting a cybersecurity degree. And if you want to do cybersecurity, that sounds like a decent plan. Do you have to do it? No.

One of my all-time favorite colleagues in security, actually my only personal friend who's had his face on the COVID of the Wall Street Journal in one of those stipple drawings, doesn't even have a high school degree. He got his education in the Marine Corps firing shells out of artillery pieces, but he's one of the best security thinkers I've ever met. And so shout out to Bruce, who I wouldn't be here without everything I learned from you, man. So thank you.

Right. And so I would be slightly careful. Like, both Tim and myself kind of highlighted the fact that degree may not be absolutely essential ultimately with each story of somebody succeeding hugely without a degree, in a lot of minds, the idea of like, okay, so I don't need a degree appears. And I don't think it's a good idea. I think that you can succeed without it, but it's not the same as you don't need it. I think that it's going to be a straighter path to a good, fun career.

Yeah. And some folks here like David are saying that they'd rather see SANS or GCIH or GCIA or practical experience in SOC.

Yeah.

Yeah.

Fair point. But to gain practical experience, you have to have a job and to have Many of the jobs, you have to have a degree. So, it sort of starts to look a little like maybe you do need a degree.

True. Well, there's many ways about it, but a degree is— a master's, or I guess extended degree, is not necessary in a lot of cases. All right. So, I know we have a few minutes left. I want to ask a couple more questions. Just talking about the podcast once again, why did you decide to start the Cloud Security Podcast? And I'm going to add on to that. Is it How you've expected it? Did it surpass your expectations? Did you think you were gonna get this far? Like, what are some milestones that you've hit?

Let me prevent us from saying something we shouldn't say. So we have a founding myth, which we need to sanitize it a little bit because of the founding myth. But the idea came to me in around 2019 for a reason that I would sanitize out of this conversation.

It was Anton's idea.

It was Anton's idea, but the reason why it came up is gonna be sanitized. And I felt like a podcast is a great idea. to have an independent voice on cloud security because there aren't that many ways to present an independent voice in cloud security out there. So, it started from that, but then I realized that the podcast would never, ever exist unless I find a co-host because I did not see it as a one-person project. Then somebody referred me to Tim, and the rest is kind of history. Actually, maybe Tim can Safe from that point onward.

So I met Anton, I knew of Anton when I worked at Shape and he was an analyst. He was one of our analysts. I met Anton in early, mid-2019, and I look at him and I say, oh, hi, I'm Tim. Who are you? We're standing in line for coffee somewhere. And he says, oh, I'm Anton. And I look at him and go, oh, you're that Anton. And so that was actually how we first met. But somebody later that year, when Anton was kicking around this podcast idea, reached out and said, you should talk Tim. And at first I thought it was kind of a crazy idea. I thought, okay, we'll get 5 listeners. Nobody wants to hear what we've got to say about cloud security. We'll do 5 episodes, see the stats, and decide it's not worth our time. And so I figured it was a very small commitment. You know, I'll do 5 episodes. What's the harm there? And so here we are, 2 and a half years later, still doing episodes every week. And I'm, for one, Stephanie, shocked and just so delighted that people find what we do here valuable. I never would have guessed that so many people would listen every week or that people would say, hey, I really, really appreciate your content. People have said to me, and I'm sure to you, Anton, I got this job at Google because of this podcast, or I'm in this role because of listening to the podcast. And so as much as I thank the guests, I also thank the listeners because it's those stories and knowing that people are listening that really lets me prioritize the time to do this. And so thank you, everybody.

Yes. I mean, it's fair to say that it's not only about fame. I mean, fame for us, that is. There are other motivations.

Are we famous? I don't think we're famous.

No, we are B-listers. I think we are B-listers at best.

I think we might be security F-listers.

No, if you're an F-lister, you don't have a podcast. You have a blog read by— I shouldn't say by your mom because that would go in a completely different direction.

My mom is probably listening right now, by the way.

Yeah, exactly. So, if you have a blog that only your dog reads, then you're an F-lister. I think we are B-listers, maybe C-listers.

Okay.

But I'm sorry, not that I'm obsessed about fame or anything. Just a little bit.

Just a little bit.

Just a little bit. But ultimately, we do realize that we have this channel for industry conversation in cloud security. And we have discussions that are useful for people just starting up, who are kind of doing their first lift and shift, they're moving VMs to GCP or to one of those other clouds. We also see people who are hardcore cloud natives and have been doing cloud for 10 years. We see how this all plays together with other security tools. I feel like we have this kind of a cloud security zeitgeist close to where we are. And this has value for us. This has value for the community, for industry, for Google, for our teams. And it's a good thing. It's really not just about fame, not that I'm obsessed.

All right. So, we have one more question here to wrap it up. So, I'm going to pick this one because I think it's a fascinating one to end on. So, what do you hope we'll have solved for in 10 years that we'll no longer be talking about in the security space?

I have an answer. Can I please go with my answer? Hello? Pick me, pick me.

Yeah, go, go, go.

It's the answer. I think we would solve configuration problems, misconfigurations. And the reason I am thinking that is because earlier this year, I realized that the first CSPM vendor was launched in 2013. So, we sort of have a 10-year bucket of time when people said, Hey, cloud misconfig is kind of a big deal. Let me start a company on that. And happy New Year, 2013. And then now, it's like 2023, and most surveys highlight that cloud misconfigurations are kind of a big problem. And I'm like, wasn't there— for 10 years, we had decent tech to kind of start fixing this problem. And I feel like another 10 years would do it. So, I think that in 10 years, Cloud misconfig would not be the leading major news-driving thing. So we will solve that.

So I'm going to answer with the same answer, but differently. I think the real opportunity is not technology. We've had a lot of conversations on the show about career growth and how people get into security because they like the technology. But to become a leader in security, you need to like people. And those 2 skills are often whatever the opposite of comorbid is, you know, people and technology. And I think what really we have an opportunity to do as an industry over the next 10 years is solve the disconnect between security and developers or security and operations. And it's through solving that human-to-human or team-to-team or org-to-org disconnect that will actually fix that technology problem. Because the technology to identify a cloud misconfiguration, it's not hard. The bucket shouldn't be all users. Easy to check. What's hard is how do I help developers build the right thing quickly and not make mistakes? And that's, I think, where the human-to-human, team-to-team, org-to-org stuff is actually what we ought to be on a mission to solve over the next 10 years. And so that's my answer.

And we're going to do it all with AI.

Oh, God.

That would solve the human-to-human part if we don't have humans anymore. We just have the AI do it.

Yeah. All right. Well, thank you so much for doing this AMA and for letting me be a part of it. I am a big fan of your work and your podcast, and I'm sure everyone here listening is as well. We got a lot of good engagement on LinkedIn. So thank you, everyone, for tuning in and asking all these questions. And for any that we didn't get to, we'll be sure to respond in the comments.

Thank you, Stephanie. This was amazing.

Yeah, thank you so much.

Of course.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @_timpeacock. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Bye. Security.

Security.