EP175 Meet Crystal Lister: From Public Sector to Google Cloud Security and Threat Horizons

Security warning.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, all on our community page. Anton, we've got another fun one in our Voices series. We've got somebody with an unexpected background today.

Yes. And that's why when I was writing the question, I said, let's sheepishly call her background public sector, but we would not do any spoilers in the openers.

You would have to No, but that question almost pulls the wool over the eyes of our listeners. Get it? Because it's sheepish.

Sheepish.

About her exciting background and how cool it is. But fortunately, she doesn't waste any time getting into it. And in fact, neither should we. Let's turn things over to today's guest. Today we are joined by Crystal Lister, a technical program manager at Google Cloud Security. Crystal, delighted to have you on the show. Thank you so much for joining us. It's my understanding that your background can be called a little bit sheepishly public sector. What's been your experience transitioning from public to private, and how have you seen, like, our— both our practices and our outcomes differ when it comes to risk management?

Oh my gosh, Timothy, thank you for that introduction, and thank you so much for having me on the show. I'm a big fan.

Absolutely.

So, straight to your question though, I am so glad that you asked this one. From a commercial sector perspective, because I do have over 10 years with the federal government and almost 10 from a private sector perspective, But thinking about commercial sector, there are differences and you went right to it.

Yeah.

So obviously in the commercial sector, very much driven by, you get it, we get it, shareholder value and the bottom line. So I think sometimes the private sector is not fully convinced that there may be a threat because they aren't seeing evidence or they lack intelligence on it. So, they may not necessarily designate budget or resources, effort, and time because resources and budgets are not infinite, right?

They aren't.

They aren't, right?

Go figure.

So, to adequately handle security. But oddly enough, some commercial organizations don't think— and here's one of the things that kind of does stand out to me and why I love this question in particular. Oddly enough, some commercial organizations don't think they are Meaning, they don't think or they don't understand.

Why would the bear eat me?

Why me? Why am I special? Why would an adversary be interested in the knowledge that my company has? Or why would they be interested in the access that my engineers have, whether it's to intellectual property, engineering, R&D, other critical assets? And I can't really say, Timothy, that I blame them because if they don't understand the threat, how can they be expected to defend against it? And so, we'll talk about that in a moment. From a government perspective, just to flip the narrative a little bit, it's really driven by a desire, right, to protect our homeland, no matter which government it is. But from a US perspective, it's really about protecting our homeland, our citizens, our military, other Western interests. So very different from the bottom line from a cybersecurity risk management perspective there.

And sometimes—

Just a little.

Yeah, just a little. Sometimes we have more than enough, a reason or justification, when you tie human life to something, your justification for budget and for extra initiatives focused on assessing risk might be like, that's an easy no-brainer yes, right? Because if the answer is no, I'm sorry, policymaker, we cannot secure that operation or that mission, that is sometimes just not an acceptable answer to the leadership of the intelligence community or to US policymakers, right? Because the risk of failure would be too great from a national security perspective. So, those are just a couple of thoughts.

No is not an option in that space. That makes sense.

I mean, even today, it's some of the discussions about ROI for security or motivating people. Funny enough, the day we were recording this, we had a brief discussion on Twitter with somebody who said, what about those businesses who don't care about security and don't find any value in them? Like, that's still a debate in the mid-2020s that this would be some organization who say, yeah, this cyber stuff is not that important. Like, sure, in the '90s maybe, but 2020s, I am surprised about that. Okay, fine.

Where are we still finding those people?

Good question, but they do still exist. So, let's briefly forget about them for now.

Yeah, let's try to forget about them.

Let's try to forget about them. This ominously stated by Tim, we'll fail to forget. But go back to crystal background. Your journey here to Google was kind of long and interesting in many regards. So, can you talk to us more about how you ended up here in that chair at Google?

Okay. Well, I guess we all know that the stork didn't drop me off. So, it's been a great journey. I got to tell you, Anton, I love the question and I love sharing because I actually— okay, I don't know if I should say this or not, but I will say. I didn't imagine myself at Google years ago. I started out, however, in the business space in academia. Then I added computer science with a strong emphasis on cybersecurity for my program. I actually had the opportunity to go to school on a scholarship from the National Science Foundation. It's a program called Scholarship for Service. And it still exists today. I highly encourage people to check it out if they know people that are interested in getting into this field. field. And it's a terrific program. And I even made, like, when I was in the program at the University of Tulsa, I made the highest grade in my digital forensics class in grad school back then. I mean, really, I just was so interested and curious in technology and how to secure it and what could a bad guy do with it and how can we learn about that so that we can better defend ourselves. So I've always been passionate about technology and how we as a society interact with it. So after the program, I had the opportunity, I'm very honored to say that I served over a decade in the US Central Intelligence Agency, where I had the opportunity to lead cyber threat intelligence and insider risk management teams and programs, really addressing complex national security issues, informing our policymakers, helping protect operations. And it really was an honor.

I bet.

But I gotta say, after that, I had the business background too, right? Remember that part. So I was really interested in building and leading programs in the startup space. So when I left the CIA, I wanted to use my business background combined with what I had done there. So I was like, okay, wait, how do we do this? This is completely different. I sat at my desk on my first day with my shiny new laptop, and I will share an embarrassing story with you. I sat at my desk on my first day in my private sector position, and I forgot to take my laptop to my first meeting. Because I didn't know it was allowed. I didn't know it was allowed. And I get to the meeting and everybody's got their laptop, right? And I'm like, oh, I'm already messing up. I'm failing. I should go running back to the federal government. So just— I love that. Just to let you know that it's not always easy making these transitions, but I think for me, it's been a great opportunity to use my skills. So during that time before Google, I co-founded and led 2 cybersecurity consulting startups. Needless to say, I had an opportunity to wear a lot of hats, which was really cool. I had the opportunity to provide cybersecurity consulting for customers in multiple verticals. So, I mean, I had a blast. I got to support the space sector, oil and gas, which is near and dear to my heart because I am from the middle of the country, which— And I'm from a state and a hometown that depends on the cyclical nature of oil and gas, right? I also had the opportunity to support IT organizations due to the nature of my networks and being in cyber and security for so long, as well as other verticals. So very cool opportunities, um, to engage with multiple verticals. And I think that for me, that was useful being a former federal employee because I was able to see how different verticals approach security, but also how within their vertical there's even key differences.

Sure, sure. So let me pick at that a little bit. I, I think that's super interesting. I don't get to talk to a lot of former CIA analysts who are now at Google. How have you brought the CIA background into Google, and how's that— how have you informed your work at Google with that? What's that like?

This is such an epic question, Tim, actually.

Thank you.

I'm really curious to hear what you think.

Just go straight for it, Tim.

Yeah, we're going in.

So, I love the question, and thank you so much for the opportunity to talk about this a little bit and articulate how does all that translate, because that's what I was thinking when I applied to the Google job posting. So I believe there are actually quite a few lessons learned from my previous work, not only from the CIA, but also the private sector that helped me when I think about my cloud security journey here at Google. And one of the things that we're doing at Google is really laying the groundwork for cloud threat intelligence. Okay. I just think this is the coolest, right? So when I was at the CIA, I was in the Directorate of Intelligence. So at that time, gonna date myself, I was actually helping shape the ground-level analysis narratives for what the agency was providing on a daily basis to the president and other policymakers and DOD leadership to inform their decision-making. So really, I came in at a time at the agency back when they were laying out some of those foundational lines of analysis on threat actor dynamics. technical capabilities, their tactics, their techniques, their intentions, their motivations, not so different than what we're seeing with the shift from what are threat actors doing because we've gone from, or a lot of people are transitioning from on-premise to the cloud and adopting cloud-native paradigms, right? So, I think I find myself in a little bit of similar, not exactly the same, right? because of the difference—

Mm-hmm.

That you talked about in your first question, to your point earlier. But I do find myself on a little bit of a similar journey where we're laying that cloud threat intelligence, not just for our organization, but also helping our customers and our users protect themselves. And I think part of the game here in threat intel that hasn't changed also is, when I was federal, I learned how to synthesize very large quantities of technical data and sources of intelligence. That's what you do as an all-source analyst.

An all-source analyst. That's a cool phrase.

Yeah, yeah. And quickly identify patterns and trends. So those are some of the things that when we think about the cloud threat landscape today are very similar. We have a lot of intelligence teams at Google that my team partners with and that we work with and looking at observations and insights and just as many sources as we can of cloud threat intelligence to help inform internal defenders and our external customers. But also importantly, I don't want to forget, is that informing decision-makers and leadership, I mean, that's still part of it. I mean, I think—

That's the point of it, in fact, right? Like, that's the whole point, is hopefully we make different, better decisions.

Right, right. I think providing that, it's really a neat place to be in. Yeah, when you're providing that forward-leaning analysis of how to respond to a threat activity and then find out and determine what is the best way to present that to a senior leader in an organization. So whether that's public or private sector.

Anton, I think you've got the next question here. It's a really nice segue from that.

Yes, I do. And it's also something that kind of further builds on that. And one of the things, funny enough, this call is kind of our second call with Crystal today because—

Oh, is it?

That's funny. Yeah, it is indeed really funny because She now leads the Cloud Threat Horizons report effort.

Oh, no kidding.

Because I am a huge fan of the report. I obsessively read every one of them, blog about them.

He does. It's true. He tells me about them.

Yes. Yes. And so what is your sort of— how is your past informing this? And what are you thinking about how we're going to make it better? I mean, broad question here. So answer however you want.

Oh, no, that's easy, Anton.

Really? Okay.

Oh, man.

Nobody ever says that about his questions.

He's just throwing the softer balls today. We're just getting warmed up, right? I think that at times what we have to think about is we don't know what we don't know about the cloud threat landscape, but we have to make calculated judgments and we have to draw that proverbial analytic line in the land somewhere. But we can do that in an informed way, right? And I think part of the vision and for the Threat Horizons report, and Anton, you and I have talked about this on multiple occasions, The TL;DR, or the bottom line, on the Threat Horizons report is bringing that threat-informed research data and analysis and intelligence, bringing that threat-informed perspective to cloud security, to Google Cloud, and, and other cloud platforms that our customers may be using. So I think that one thing I can share that I'm very excited about the vision for Threat Horizons report, because you did ask me to touch on that, Is that this coming July is gonna be the 10th iteration. I'm just gonna say it again because—

Oh, you're one of those confident people who likes to give dates on projects? Tim, you're a PM. Isn't it illegal to give dates?

No, it's deeply impressive. It's really good.

It's deeply impressive.

It's deeply impressive indeed. Yes. I was like, she didn't say later this year. She said in July.

No, in July.

So, what are we getting in July? Tell us about it.

So in July, we're going to see the 10th iteration of the Google Cloud Threat Horizons report, which is an OSISO-sponsored report for industry that provides those actionable security risk mitigations based on what our Google Cloud security teams and experts, other intel teams and partners are seeing in the cloud threat landscape. And as I mentioned, I think the reason why I said that date twice, that it's the 10th iteration twice, is because There is a lot of work and effort that has gone into making this the premier report and offering for our customers and users that it is. So it gives us an opportunity to apply our expertise to help them protect their cloud infrastructure services and technologies, right? And I think that's just really a great opportunity. So for this iteration, just a little bit of a preview, it's going to be focused on threats to serverless computing.

Ooh, that's a good area. When you say serverless computing, what do you mean? Because that can mean a lot of things to a lot of people.

We're gonna have another episode now.

Sorry, that's a whole other episode. How about we do it in July? Yeah, we'll bring it back in July, listeners. I don't wanna go down that one right now. Okay. So, I wanna shift gears a little bit and get away from cloud and serverless and ask about Insider. I'm sure when you were in the Fed—

We need to have an ominous pause. Wait a second.

You forgot the ominous pause. Insider. I'm sure when you were in the federal government, insider was a scary thing. Are people still worried about insider outside of the feds? And what kinds of companies in your experience ought to be worried about it?

I love this question.

It's like 3 questions in one. I'm sorry about that.

3 questions in one. These questions, so keep me honest, please, because it is Friday afternoon. And so, So you can see I'm with you, but am I really with you? So keep me honest. But I love talking about this and I'm so glad that we get an opportunity to touch on it in the short time that we have today. But my answer is absolutely insider risk is definitely something that companies should be thinking about. But before I get into a little bit of the types of companies that I recommend to keep that something in mind.

Mm-hmm.

Really, I mean, when we think about insider risk management, it is compared to some of our digital threats, right? Like ransomware. I mean, I really view that, you can almost view that as 2 very different types of threats. So, like a digital threat like ransomware would be like an apple, insider threat risk would be like an orange. So, very different. Although the endgame may be the same, right? Detrimental harm to an organization or to its workforce.

Mm-hmm.

The risk presents itself and how that risk can then spiral out of control are 2 very separate things, at least in my mind. As you have digital threats that are very technical to mitigate from a cybersecurity standpoint and focus, right? And there are steps that security practitioners and defenders can or should rely on and best industry practices for doing that and protecting from digital threats. But an intentional insider is something very different. It's different because an intentional insider can be even more complicated to detect and prevent against. Because if you picture, like, an intentional insider threat could be the coworker sitting next to you in the, you know, in your office or your bullpen. They could be riding the elevator.

It could be Anton.

It could be Anton.

Probably not. It could be me. No. You're way too trustworthy, Kim.

Yeah, but, you know, it could be the person you're having your next virtual meeting with. So that just kind of makes it a little bit more real because I know that insider risk, it's hard unless you've seen it or dealt with it. It's kind of like the wind. You can't see it, but you know it's there. And even in the history of the federal government, or at least I know from my research based on the intelligence community from a US perspective, I don't believe there's been a time that they are aware of that they've shared that they did not. have an intentional insider. So, we know that about the federal government. If we were to pick up a rock in the commercial space, I'm curious for some industries and some organizations and companies in particular, what would that look like? We may never know, but it's a curiosity I have. So, when we think about who would need an insider risk management program, was that your question?

Yeah, yeah, yeah. What companies in particular are going to need to invest in that? Like, who should be most worried about that and maybe who shouldn't be worried about it? Back to your question about really, is the bear going to eat me of all people?

It's definitely going to eat you.

Yeah, Tim is just way too appetizing. So I think that debate is over.

Appetizing. Oh boy.

For a bear.

For a bear.

Keep me honest. Keep me honest.

Yeah, please.

So when we think about the types of industries that would benefit the most, how about this, Tim? Let's take it from this perspective. And Anton, you jump in too. I want to know what you think. When we think about, well, who needs insider risk management? I'm not going to be biased and say everybody needs insider risk management because frankly, that just may not be true. But when you think about it, it starts to get easier to answer, right? When you think about heavily regulated industries, companies that deal with sensitive technology or whether it's ITAR or EAR information, because fines like for exporting things that you shouldn't be or companies shouldn't be, those could be kind of heavy, right? And you can't just or maybe you shouldn't just hand over your technology or export it to some foreign countries because you'll lose your competitive advantage. So really, if you lose your IP, for some companies, that means they're going to lose their business, right?

Yeah.

I think it's really important that leaders of a company understand and define insider risk management and then agree when they think about insider risk, what areas of the company actually would need to be in scope for something like that. Is it already? Is it finance? Is it both? Is it something else?

Sure.

Because our companies look so different now because almost every company today, whether they want to admit it or not, I mean, we're all in the business of data at this point. A lot of companies are finding themselves in the business of data just due to the nature of the world we live in today. So, I think that identifying what those critical assets are that could most harm your company if they were Are they vulnerable? How would you protect them? I think companies have to make that decision for themselves, obviously, outside of heavily regulated ones.

Yeah, yeah, yeah.

I think anchoring an IP is a really good idea because I feel like nowadays when we look at AI and models, there are certainly types of IP that are so portable and so easy to steal that it almost makes sense to— your choice is pay an insider $10 million or pay for development and training the model $100 million. I can see where this becomes— with this ties to this type of new types of IP that are very stealable and very portable, where you get all the value if you steal it. So, I can see that reviving the insider threat aspects. And of course, when I say insider, I really just mean the intentional insider. I think the other kind is okay, but not as fun as the actual— somebody planted or bribed or something. Okay. This is a really fun episode. We should do an insider threat-focused episode at some point. Yeah. We should do a whole other episode, Krzysztof.

We've got 2 episodes coming out of this. We got an insider episode and we've got a serverless compute episode. Anton, you've got one more question about some of Crystal's work outside of Google, and then I'll close this out.

Yes, this is an important one. You're also involved with women's sponsorship program in DC. And given we want to talk more about you as a person and not just the topic, of course, we would never stop talking about insider threats. But this aside, can you tell us more about this part of your work and this type of your person?

Absolutely, Anton. Thank you for the question. I can tell you and share with you and Tim that one of the things that I love working about at Google is the opportunities and the support to give back to our local resource groups. And the support that I receive from my leadership team to mentor women in the cybersecurity field is just phenomenal. It's very refreshing to be at a company that supports that. And one of the initiatives that came out of me kind of looking for opportunities to support women and Googlers in my region, and came from starting to talk to other Googlers in my region about how could we do that. And we identified that there was a need for a women's sponsorship program in the Reston and DC area. We put together a program management team. Jeanette Monfrah, the Director of Google Cloud Risk and Compliance, generously offered to be our executive sponsor. Wow.

Amazing.

We have an incredible program management team for the effort, and we work closely in partnership with other Google Women ERGs in our area to do that. So just this year in April, actually last month, we did a dark launch for the program where we matched successfully 6 pairs of sponsees and sponsors. And the goal of the program is to meet the need for career development for women-identified Googlers in our area by creating those intentional sponsorship opportunities. And so, we're very excited to have this effort and be a part of it. So, thank you for asking.

Yeah, I love that answer. That's great. I hate to do it. I really hate to do it. Could you give us one tip to— gosh, I don't even know what to ask you for a tip on.

Insider threats. Just go for insider threats because this is the one that—

All right. A tip on insider and any recommended reading.

Okay. One tip On insider threat, okay.

Yes, please.

This is a tough one because there's so, so many. I guess I would have to go with leadership agreement on— I've seen in my time as a cybersecurity consultant prior to joining Google too many times where senior leadership doesn't agree on what the critical assets are at their organization. And that just continually leads to a whole host of issues with then how to prioritize and identify security controls to So, if there was one thing that I would encourage anyone to do at their company when it comes from an insider threat risk management standpoint is not make the assumption that the entire leadership team automatically agrees and identifies with what the most critical assets are that need protecting, because that can mean something different to different people.

It sure can.

And from a reading recommendation perspective, I'm going to go with an oldie but a goodie. Really digging out from my past here. I get a lot of questions because I was an all-source intelligence analyst for the US government on how do I get started in this, or what would a basic starter foundation book be? And I think one of the first books that was given to me during my training with the federal government was The Psychology of Intelligence Analysis by Richard Thure. And it just kind of is going back to the basics here on threat intelligence. That could be cyber, that could be economic, that could be political, that could be military. But I really think it lays a good foundation. or how to get started in the field.

Well, that's amazing. I'm going to have to get a copy of that and check it out myself. Crystal, I can't thank you enough for joining us today.

Thank you so much. This has been so much fun. I really appreciate it.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity, Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @_timpeacock. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Bye.