EP206 Paying the Price: Ransomware's Rising Stakes in the Cloud

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Tim Peacock, the Senior Product Manager for Risk Analytics in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners all on our community page. Anton, we're talking about ransomware today, and there's a really fascinating piece of nuance you managed to draw out of the guest around the relationship between insurance payouts, survivability, viability of the ransomware model. It's complex and nuanced. I don't want to give it away, but— Are there other things you want to highlight from the conversation? Because that's been rattling around my head.

Yeah, my impression is that the guest today is one of the leading experts on ransomware, just period, flat out, no additional qualifications needed. So he provided a few really interesting insights. And now you would assume ransomware is kind of a— maybe not old news, but ransomware is something we've had since, you know, 2015. We've studied it. Google studied it. Many threat research teams, many other vendors studied it. But it still represents a fascinating exercise in the security, technology, culture, economics, insurance. It is kind of way more fascinating than just, ah, there's some kind of attack vector called ransomware. I mean, we're beyond ransomware is malware. Ransomware is very much, you know, not just malware, but—

Ransomware is a way of life. I mean—

It's kind of like a way of life argument rather than something else. So this to me is a—

Yeah, no, I think ransomware is so fascinating from a societal response to criminal activity. There are interesting political science— and listeners, if you don't know, I was actually a political science major in undergrad. That's what I studied at Brown. I think there are interesting political science lessons about state capacity, state willingness to tolerate things, and the intersection of regulation, technology, and the limits of the state, in fact. There are so many things we can say about ransomware, but let's turn things over and hear what Anton says as a world-leading expert has to say about it.

Hello there. I think our traditional start is, hey, hey, is this thing on? But I think today will be more formal.

Sure, we can be formal.

You can be formal. And today, as you can see, I have Hadlin with me on the same camera, my temporary co-host for the MWISE Live show.

Hi everyone.

I'm Seth Rosenblatt. I'm the cybersecurity editor for the Google Cloud Blog.

And our guest today is quite amazing, especially the title. It's Alan Liska, the ransomware sommelier. Hello, welcome to the show.

Thank you.

Thank you. I'm really excited to be here. And I mean, I'm a big fan of yours and the podcast, so it's awesome to be on it.

So ransomware, some people would say, is kind of a 2015 topic because that's when it was born, but it's also a very 2024 topic, as we know. So first, a very easy question, Alan. Just give us an overview of the current ransomware landscape. And also, why is it still with us? Why is this problem still with us?

You know, I talk to a lot of executives now who tell me they have ransomware fatigue. They're tired of hearing about ransomware. They're tired of the latest briefing on ransomware, and they don't want to hear any more about it. And honestly, since I've been talking about it since 2015, I don't want to talk about ransomware anymore either. The problem is it is likely next to business email compromise, still the most profitable form of cybercrime. And that's why it sticks with us because the bad guys make lots of money at it. Not all of them, but enough of them do that they're gonna continue to carry out attacks and our defenses haven't evolved the way they should.

Hmm.

So I have an embarrassing revelation about this. Somewhere around maybe 2015, I argued with somebody from a vendor. I think it was at Gartner at the time, and we were arguing what's more profitable, stealing credit cards or ransomware, a long time ago. And I am personally probably very naive because I tried to argue that actually stealing credit cards is a better business. I ate a lot of crow since then because of that statement, but it's interesting that it has the staying power. The business model has staying power. It's not just like a— Yeah.

Yeah, no, absolutely it is. I mean, and the other aspect to this is ransomware is the only cybercrime. I mean, hell, it may be the only crime where it has its own PR arm, right? Where you have the bad guys on the other side bragging about all of their victims and so on, which again attracts more people to it. You don't see that in BEC. You don't see that in credit card crime.

Yeah.

The only other example I can think of is when We have some small towns in the US where somebody will knock over a gas station and then go brag about it on their open Facebook page. But that's really the only time that we see people bragging about it. So it gets outsized attention, even though it also makes the bad guys a lot of money.

Can you talk about why that is? Like, why is it that the bad guys are so excited to talk about their ransomware successes?

It's built into the extortion model because the only way that they're going to get paid If assuming that you have good backups and you can restore from backups, is that their hope that they can shame you into paying? And so they have to do that, but it also serves as a marketing tool for them because most ransomware operates as ransomware as a service where you have the person that runs the ransomware and they rent out their infrastructure. And so when they brag about a lot of victims, they're able to attract more people to their ransomware as a service. And so basically, it's 2 revenue streams, right? Because you have to pay to join the ransomware as a service, and you have to pay when you're a victim. So again, it has double purposes for the bad guys.

And also, there's a business model behind it, right? And you'd assume that every crime committed for profit would have sort of a business model, but it seems to be a lot more mature and robust. I'm thinking about sort of CMM maturity scale, but not for SecOps or security, but kind of for the Business operation of criminals. Like it's also a very mature, well-polished business model, right? Can you talk more about this? The business side of ransomware. Like if it makes, are we normalizing by saying by saying like this? There is a business side to ransomware.

I prefer ecosystem to business, but but but effectively you're correct. I just don't want to give them the benefit of calling it a business because that's how the ransomware operators view it, right? I mean, we see this in their ransomware notes or in their discussion. They're like. We're just a business. We're just doing pen testing, you know, and it's like—

No, you're not.

But yeah, there is a whole ecosystem built up around that. So when we talk about a ransomware attack, we talk about it as if it's a single event, but it's not. We will say RansomHub hit this victim, right? But first there was an initial access broker who got the access, and then that initial access broker sold that access to an affiliate that happened to work for RansomHub. And so then that's 2 threat actors.

Yeah.

And then once the, you know, everything's encrypted and the data's stolen, then you're dealing with the operator of RansomHub who's handling the negotiation and taking the payments. And then RansomHub, the person behind RansomHub, is using the money that is paid to them to hire developers to improve their ransomware. So like we saw this with Play ransomware, right? Play Ransomware started off as one of the freely available ransomware, and every time they got a ransom payment, they would pay developers to make enhancements to that, and they continue to improve over time. So it really is, in effect, a business model, but it's an ecosystem built up. And because it's multi-tiered, you have a whole bunch of people making money in different ways in support of ransomware.

So I think that it's still a good catch to sort of By saying it's a business, we almost like agree with them and sort of normalize them without saying it's a criminal ecosystem that of course makes money. I think that's fair. What about the aggressive tactics? Like you keep seeing it in the news because ransomware is one thing that kind of broke out of IT to sort of affecting normal people. We interviewed somebody on this on our podcast and his motivation for going into fighting ransomware was it's the biggest cyber thing that affects people that are outside of IT and cyber. So, and we hear about those kind of aggressive tactics going after, you know, executive families and whatnot. I think Kevin Mandiant brought it up last time we spoke about this. Like, what— can you shed some light on this? Like, what's going on there? Why can't they— why doesn't the normal techniques of ransomware work? Why do they have to resort to things that are scary?

So as you said, you've been doing this since 2015, specifically with ransomware. I know you've been in the business a lot longer than that, but Starting really in 2015, we did things like we really emphasized the importance not just of backups, but following the 3-2-1 rule, right? And so eventually, slowly, organizations started doing that. And so they were able to recover from backups more effectively. So now just encryption didn't work, so you needed the data dumps. But now there are so many victims, there's so much stolen data out there that like it doesn't impact the company stock anymore to find out they got hit, mostly. got hit by ransomware. So now they have to do things like, okay, if we hit a school, we're gonna email the parents and say, hey, we're gonna release your kids' sensitive data. Or yes, we're gonna, you know, try to deploy violence as a service tactics or DDoS tactics. So they're continually finding ways that they can put pressure on the victims and remind them that the ransomware actors have so much data that they've gotten from inside the networks that they have a lot of different tactics that they can follow. You know, we saw this, you look at what happened with the ransomware attack that impacted all of the car dealerships in the US, not all, but many of the car dealerships in the US. You know, we saw that the ransomware actor was talking about reaching out to the individual car dealerships and offering to take a ransom from them. Now, it wouldn't have mattered—

Mm-hmm.

Because that wasn't the problem. Like they could have paid, you know, the ransomware actor wouldn't have actually had the capability to do that, which is one of the things that we have to keep in mind. The ransomware actors also lie a lot. They make things up. It's immoral, right?

It's sort of like—

Right. So they're not afraid to reach out to victims of victims and promise them things they can't actually deliver if they think they're gonna get paid.

That actually leads us, I think, to a really important question. What are the key factors to consider when an organization needs to decide whether or not to pay the ransom?

So, and I think we've been over this kind of over and over again. If it's always a security decision, the answer is never pay the ransom, but it's not. It's a business decision. I think the more interesting side of this is the regulatory side.

You mean like paying the ransom? Is it the same as, or is there more to it than just like, petitioning government to make it illegal.

I think that is possibly an option. There are some real problems with it. I've gone from being absolutely against it to like, because we can't seem to stop it, we're not improving our security enough to stop it. So maybe instead of the carrot, we do need the stick of no, it's illegal to pay ransom. Although I like what the UK is proposing for their law, which is essentially a ransomware license. So you get hit with ransomware, you report to the NCA that you got hit with ransomware and that you have to pay a ransom. That gives the NCA a chance to come in and say, oh, hey, maybe we have a decryptor, maybe we have something that can help. But if you have to pay a ransom, they know that you're paying a ransom, who you're paying it to, and how much is being paid, which allows them to better track it. Now, I don't know if that law will pass, but I think it's a good—

Mm-hmm.

sort of mid-tier solution for, or in-between solution between no ransom payments ever and pay all the ransoms you want. But one of the problems right now is we don't really have a good solid reporting structure. Most victims of ransomware are not required to report it.

Mm-hmm.

Now, if they bring in somebody like Mandiant, Mandiant is going to report if a ransom is paid because Mandiant does things right, but not everybody does incident response. Correct. What I would consider correctly. And so most ransoms never get reported. And then we wind up with companies like, you know, wind up relying on companies like Chainalysis who do an amazing job, but they're the ones that even governments get information from about how many ransoms were paid and who's getting paid, et cetera. There should be a centralized government database somewhere that everybody can refer to and go, wait, I don't need to know who the exact victims are. The government does. I don't need to know. But they need to know, hey, who's getting paid, what wallets are getting paid, et cetera, so that we all understand how big this is, how big ransomware is.

So a sunlight solution.

Yeah, yeah, 100%.

So how big have we estimated the ransomware problem to be?

That's really hard, right? Because with most, with I think most of them not getting reported, we just don't know. But, you know, again, looking at Chainalysis reporting, Last year they reported 10,000 ransoms paid. I mean, that's a big number. And, you know, that's just the ransoms paid. And we think—

Some of them are maybe $1,000.

Right.

So wait a second, the 10,000 is a number.

10,000. And then the median payment that they saw was just over $200,000.

So—

That's a lot of money as like not an outlier, but as like normal.

Right, right, exactly. So 10,000 victims, median payment of $200,000, but also we only, we think only about 25 or 30% of victims pay. So how many more victims beyond that 10,000 were there that we just don't know about?

And what's the record largest?

Like you mentioned of the median, because it's $75 million.

$75 million.

Yeah.

In one.

In one payment. Yeah.

Jeez.

I mean, we should just, like, pause for a moment and, like, be briefly freaked out about that. I don't want to go on a painful subject because I want to ask about cloud, but isn't it, like, a case some of those companies, maybe R&D, there's no money for security, but there's suddenly money to pay ransom? Like, this is an incendiary subject and all that, but, like, can you comment something fun and interesting about this? Because I'm talking about one company in particular, and I would not name names here for this. Like, it's the company that keeps saying we don't have money to do cyber, right? And then suddenly here's $75 mil if you're an attacker. Like, that freaks me out a little bit. And is there like explanation to this?

So some of it may be coming from insurance, though, certainly. And you and I have both seen this. After victims are hit with ransomware, suddenly the security budget opens wide, right? And it's like, Well, where was this money before?

Exactly where was it before?

Right.

And so whether it's that you can suddenly come up with the money to pay ransom or wherever, you spend so much less and have an effective security program if you kind of put some thought into it and so on.

So how can organizations— I mean, it sounds to me like what we're talking about is a misalignment of incentives. that the incentives for doing the right thing are not aligned with what's actually going to cause the changes that we want to see. So how do we get organizations to change that up?

It's really interesting. So one of the things that was supposed to do some of this was some of the SEC-required reporting. So you had to start filing 10-Ks and so on. But we saw already this year that the company behind the company that made the software used by the auto dealerships They paid a big ransom. They didn't file anything with the SEC. And when a bunch of reporters reached out to them, they said, oh, it's because there's no material anymore. That's right. And so the problem is lawyers. I'm sorry, any lawyers listening?

But wait, is this a signal to an attacker to ask for more money? Like, he's a ransomware operator. He ransoms me. He asks for $100K. I pay $100K. I don't report it. People say, why not? I said, so So the guy says, okay, give me a million of those. I'm sorry, like, I know we're joking about it, it's a serious subject, but non-materiality is a signal to an attacker, ask for more money, we have them.

Right, right. So, and again, that's the problem with these huge ransom payments that we're seeing. And we've seen, this is the first year that I can remember that we've seen 3 8-figure ransoms paid. And that signals to the ransomware groups and to people who may be thinking about doing ransomware, Oh my God, like that's life-changing money. I just need to hit one of these victims. And that makes it harder. So the argument against banning ransom payments is, say a hospital, a rural hospital, small rural hospital gets hit, they have to pay a ransom because otherwise there's no other hospital within 50 miles and patients will die. But also, if you're a healthcare provider and you pay an 8-figure ransom, you've now put a target on the back of all of those small rural healthcare providers. So that's just as bad.

Yeah.

So yeah, there needs to be some accountability when we do that. And I don't know how we write laws that lawyers can't get around, but we do need to— there needs to be some accountability for— not for everybody. I have a lot of sympathy for a small business or again, a small rural hospital that's forced to pay a ransom. I don't have it for a publicly traded company worth billions of dollars that can't implement basic security because we're not talking about new and innovative tactics for the most part. Occasionally, we see something new and interesting, but for the most part, if you had, you know, 3 years ago, you know, it would've been Cobalt Strike, Mimikatz, PowerShell scripts. It's still Cobalt Strike, Mimikatz, PowerShell scripts with some PsExec and, you know, living off the land and so on. So we're not necessarily talking about new and interesting techniques. We're just, not able to detect those techniques.

I've been trained to be careful with the word basic because they would have done it if it were basic to them in their realities. But also, your point stands. Some of the stuff is very much the 1990s practices and 1990s tech. There's no extra cognitive leap to figure out what to do. They sort of know what to do. It's just doing it is hard.

Right, right. I mean, it's easy to stand here in a podcast and say, you need to detect Cobalt Strike better, which you do.

Yeah.

But I understand it's hard to do that. It's hard to implement that, but you still have to make that effort.

Yeah.

It veers into just patch faster kind of like a conundrum when people say that and without any much thinking about how people would do it. But one environment, cloud in this case, this being a cloud security podcast, is sometimes mentioned as an environment where there's less ransomware. But in other cases, people kind of keep telling scary stories about, you know, exposed MySQL servers with no password. encrypted by attackers. So what is your take about cloud and ransomware? Are they friends, enemies? Are they— is cloud an environment where there's less ransomware because of security, because of unrelated reasons? So give us the cloud plus ransomware take, if possible.

So about 30% of the attacks that we see now are data theft only. So no encryption, they just steal data, right? So they just steal data. That's up from about 10% just a couple of years ago.

Hey.

And the thing with the data theft attacks is it doesn't matter where they steal the data from. If your name is on it, you're the one that's going on the extortion site. My marketing team really hates this analogy, but, you know, part of what we've started to have to do in security is more data governance, right? That didn't used to be part of the security, but now it's very much part of security. And the thing is, with data governance, You need to know not just where your data is and where your data in your cloud is, but where your partner's data is and where your partner's data in their cloud is. So, it's like STDs, right? It's not just who you've slept with, but it's who you hold hands with.

That analogy I really hate.

They really, really hate that analogy, but it sticks in people's minds. So, we have to be better about data governance to understand that and to understand where all of our data is. And too often in security, because we're isolated from the rest of the organization, we don't even know where all of our data is.

So does cloud help that? Cloud does help that. You know the answer.

Well, I know the answer, but I want to hear more specifically about that intersection of ransomware and cloud.

It does, as long as everybody in your cloud chain is following the right security procedures. And that includes No buckets being left open and so on. And so your idea of asset management and data management has to include what are your security requirements, not just for you and your cloud, but your vendors and their cloud. And how do you get that attestation in? Are surveys enough or do you need— I mean, I know that as a SaaS vendor, we at Recorded Future, we have some of our clients that want to pen test not just us, but our vendors as well. And so you have to think about how you're going to check that and how often you're going to check that. And if you have a vendor that doesn't meet your requirements, what is your process for that?

And that also gets back to the classic question of who's responsible when it comes to the cloud. Because if the cloud is, you know, is a partner in keeping you secure and they're not telling you that you have An insecure bucket or whatever.

Ransomware, cloud, and shared responsibility triangle is really fun. I mean, fun in a bad way. Not like, haha fun, but more like, don't disclose the silver kind of fun.

It's still cheaper than the $75 million bar tab for getting used to it.

Probably, yes.

I mean, that'll buy a lot of Château Margaux.

Yes. And at the same time, it will also buy a lot of CloudSec tooling if you are doing it By the way, data governance is a very funny beast. A lot of really cool AI hacking, our podcast tomorrow, AI security, very novel, modern, cool stuff. When you start realizing, how do you actually— what is the main principle for actually improving security of that? And people are like, in hushed tones, it's data governance. And then it's like, no, no, no, no, no. Give me a LLM firewall. And I'm like, here's the LLM firewall, but you also need data governance. Sorry for taking a detour from ransomware, but data governance. Yes.

Data governance is intrinsically— but data governance is now intrinsically tied to ransomware. You know, I mean, it's— so have you all ever worked in a SOC?

Sort of. I mostly not firsthand, but I've been to SOCs.

So I got my start in the SOC and the SOC quickly became the dumping ground for everything that had logs, whether or not there's any security value for it. And often it still is. This is what we're starting to see with security. Too many times I talk to CISOs and they're like, okay, now I'm responsible for data governance. Also, I need to know what Iran is doing and I need to know—

And like, I think artificial AI is on your plate too, dude.

Right. And now I need to know all the ransomware laws. Like, you know, I need to know much like the SOC became the dumping ground for everything logs. Anything even remotely security-related now becomes the CISO's responsibility without more budget, without more capability. But it is things that you need to start thinking about, unfortunately, because you're the one who gets fired when something goes wrong.

So I'm going to check for audience questions very briefly, but we also have this question of one thing to do to sort of improve your position. I mean, Hopefully without spending $75 million. So, if you have a question of what's the single most important thing of advice you would give to organizations looking to bolster defenses, what would it be? And it kind of has to be one. It may be one per industry if you want to, but it can't be like, do these 237 things. Yeah.

So, broadly speaking, you have to do the basics because without the basics, everything else— and this goes to your point, like, I can get the new latest AI whiz-bang thing from Black Hat or RSA, It doesn't help if I don't know what is my data. And that means that basically you have to have a triage of good asset management, good identity management, and good data management. If you've done those things, and they're not sexy, like they're not cool, nobody's gonna invite you to do a keynote at Black Hat because you've managed to do that sort of trifecta really well. But you have to do that because anything you bolt over the bad data— is going to leave you more vulnerable. So knowing what you have and what's talking to who, knowing who is in your network and what they should be doing, knowing where and how your data is being stored. If you can do those 3 things really well, then it's a lot harder for the ransomware actors to even get access to your network.

So on the who, what, where journey, what's the first step? organizations who haven't been doing it?

So, you know, there are a couple of easy things that you can do, like, that are very low cost. One, look at the KEV list from CISA. I really like the KEV list. It's not perfect, but as a, here are the things that are being exploited now by the bad guys, compare that against your tech stack, then right there, there's your sort of like, hey, here's our patching regimen, right? Like, let's prioritize patching these things. To your point, We can't patch all— there's going to be 50,000 CVEs this year. You are not going to get to patch them all in a timely manner, but these 10 things you need to patch now. That's much more doable. Same thing. I love Troy Hunt's Have I Been Pwned? I know there are better services and everything out there, but he offers a free version for even small businesses. Hey, here are all the leaked credentials that are in my network. Let's get those passwords changed. And those things are relatively cheap to do it. But if you can do those 2 things, You're already keeping out a lot of the initial access brokers, and that's a good start. And then build, you know, knowing your full network scan, knowing what's running on all of your endpoints, enabling whitelists. Stop giving everybody local admin access to your network.

Yeah, let's do it again. Stop local admin. No local admin. But doing those kind of basics and building up from there, that goes a long way to, you know, keeping your network By the way, a subtle point, like, I kind of picked on you a little bit the previous time you mentioned basics, but these are kind of the basic basics. These are not fake basics like patch faster or get great asset inventory that works current every time. Like, there are some of them are kind of like, I just had made up the concept of fake basics that sound basic but are really, really hard. But these basics are kind of like the legitimate basics. The no local admin is in that bucket. And I think that other stuff is also in this type of inarguable basics. Like, they really are basic. If you're not doing them, kind of shame on you type of basics compared to other things. Like, if you can't fetch faster, fine. But if you can't fetch 10 things, no, not fine. Sorry, guys. It's on you. So, that actually makes sense. And I love that. I think there is value in this advice for pretty much everybody. By the way, The only audience question we are getting so far is, what did you do with Tim? And the answer to this is Tim is on vacation, so he's having fun.

Yes.

He was having fun until today, long story. But the point is that—

Tim is very pleased to know that you are worried about him.

Yes, we'll let him know that the audience is worried about Tim. Tim's fine, and he'll be back.

Great.

We have like 2 minutes. So, I want to ask you this awesomely painful question that goes— gets political very quickly, and it does not involve pagers. The role of cyber insurance. I think that the— I'm getting some subtle disturbance in the force where some people claim that cyber insurance, by making the payment much easier, by making people more willing to pay because it's somebody else's money, I don't buy this argument, but I've heard people make this. So it's, they're almost making it sound like cyber insurance is a problem. I am befuddled by that. I mean, I don't understand what to think about this. So can you straighten me up a little bit in this regard? Like, I don't know. Like, I thought cyber insurance is great, and then suddenly, oh, that's a much easier way to fund attackers. Oh, whoa, wait a second. No.

So I think there's been a change in the cybersecurity industry over the last couple years. You know, there were a couple of headlines a few years back about how much money cybersecurity is losing for their companies, which I was very skeptical of. But when I talked to a lot of the bigger cybersecurity companies, the more established ones, they have really been focusing on reducing the payouts. Not— some of them refuse to pay ransom at all. A lot more of them are doing that. But in general, they're reducing payouts because before they'll renew a policy, They're much more aggressive in testing the claims of the people that they're insuring. So, it's not just enough to fill out a survey anymore. They actually, you know, a lot of these new insurance companies or old ones that are really moving to a 2.0 model have pen testing, you know, have all of these other arms that really test your network to make sure that your defenses are where they are, and they will not renew your policy if they're not. Now, there are some newer people who are getting in cyber insurance that will insure anybody, and those certainly are going to be problematic, but—

But they will go out of business very quickly.

Well, that's the hope, right? But the bigger and more responsible ones, and then when I talk to these insurance companies, they tell us they're seeing fewer victims in their portfolio. And when they do have a victim, the payout, what they have to pay to help the company recover is a lot smaller because they've implemented these changes. And so I do think overall, cyber insurance is more of a force for good than it was a few years ago. It still has a lot of work to do. But if we can get more cyber insurance companies to take these kinds of aggressive steps, then that forces organizations to improve their security internally.

So the value, the real value for good is in forcing people to improve faster, not in generating money for hackers faster, but in making the victims, affected companies to improve faster. That to me makes sense. And I think that reduces— clears the fog in my head. So we have kind of no time left. So our traditional closing questions. Well, I guess you've given your tips. So any reading materials on the topic? Anything fun? Fun reports, blogs, anything?

I really like— so there are 2 things. I really like the latest Chainalysis report on payments. And then I always Just if you want to see what the bad guys are doing, that's a great way to get a list of tools and everything that you can start detecting. So those are kind of my 2.

Perfect. Thank you very much for being on the show. This was amazing. A little ad hoc, but good advice to companies, too. So thank you very much. Thank you.

Thank you.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, Or wherever else you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvakin and TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.