EP212 Securing the Cloud at Scale: Modern Bank CISO on Metrics, Challenges, and SecOps

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts, as ever, are myself, Tim Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our listeners on the Google Cloud Security Community page. Anton, we have a returning guest today, and this was a totally delightful episode that spanned from express kidnappings, the value of constraints in architecture, the importance of IAM, How to select SecOps, how to be a CISO that does more by doing less. It's all over the place and all totally wonderful, but I don't have something pithy to say about it. Do you?

Yes, I think it came to me.

You do?

It came to me after we recorded and before we started recording the opener, because in this case, we are really in some of the kitchen. We are recording the opener right after. So in that period, I've kind of realized that some of the stuff that the guests shared is kind of excerpts from a playbook of a modern CISO.

Yes.

I think these are modern CISO wisdoms. This is not the 19— another '90s joke coming. This is not a 1990s CISO wisdom. This is kind of a condensed wisdom of a CISO who is very now.

He's the model of a modern major CISO.

I think he is the model of the modern CISO, correct. And I shouldn't sound even remotely offensive to any CISO who modernized after starting many years ago. But it is kind of a great contrast between somebody who is stuck in the '90s.

Yes.

I've seen those.

But we don't have a lot of those on our show.

Like firewall appliances. Firewall appliances joke applies to these people. And you'd see the joke, you'd hear the joke soon.

We made a firewall appliances joke on like episode 10. I can't believe it has come back to haunt us this many years later.

Firewall appliances tend to do that.

Well, listeners, with ghosts of firewall appliances past, present, and future, let's turn things over to today's guest. Today we have returning to the show Dave Hannigan, CISO at Nubank. Dave, thank you so much for joining us today. I've been looking forward to recording this for ages. Always a pleasure to have you here. Can we just start off and tell us about what you're doing as CISO at Nubank and how different is that from your past life at Spotify? Because I have to imagine different universe altogether.

Yeah, well, first, thanks for having me on. It's great to be here. Different perspective now, not being in Google. So It's super exciting to come and tell our story. Differences. So there's a lot of differences. So I guess I'll start more at a higher level. Obviously, for those who don't know Nubank, we're a— they call us a neobank, not necessarily a fintech, a neobank. We're online only. We are the largest fintech outside of Asia, right? We've got about 110 million customers right now. And we're just growing like crazy. So—

Wow.

I think that's probably the first difference is that We're a financial service institution as opposed to Spotify, which has some financial services when you're paying your bills and the likes, but that's not the focus. The focus is delivering a great experience with sound, not just music over at Spotify. And for us, it's really about changing and breaking down all of the barriers and making banking easier for our customers. What does that mean from a security perspective? There are a lot of interesting things about being in Latin America, and I think One that highlights it the most is just how the regulators look at us. We've got a little extra burden is how I would describe it. And that's not bad. The burden is an ignition for innovation. And I'll tell you what I mean. You know, here in the US, there's a clear delineation between like who's accountable for like fraud as an example.

Hmm.

You click the button and you send that to the fraudster. Guess who's liable? Not the bank, right? It's you. Well, in Brazil, Bacen, who is the central bank, says not so fast there, financial services. You have all the technology, you have all these smarts, you have all these security practices, so you're not off the hook completely. You own part of that fraud. So that drives innovation on our end and saying, okay, I can't ignore that because there's a financial impact into our company.

I'm pretty sympathetic to that Brazilian regulator right there.

Yeah, I would definitely say the same exact thing. It's like, like, it's fair. It feels fair, actually.

I think it's fantastic, right? Yeah, it's very fair. I mean, think about that viewpoint where banks are always pitching how great they are in fraud protection, blah, blah, blah. But the minute you get had, even though they have these tools, like, oh no, it's not our issue.

Yeah. The moment you sell something, forget it.

Yeah.

Oh yeah. Then Zelle's getting beat up like crazy.

Yeah, they should be.

And you're seeing a lot of that.

happening.

And I think that's one big difference. I wasn't expecting a Brazilian central bank to be leading in that manner. Right. And then truly they see themselves as they're there to really protect the consumer and they're going to force financial service companies to do the right thing there.

So you know what it reminds me of? It a little bit reminds me of shared fate where it's kind of the who's got the money and the knowledge. It's the cloud provider.

Yeah.

Who is blamed in the court of public opinion? Well, the customer.

Yeah.

Wait a second. So it's like basically the founding story for the shared fate approach that we practice often. Can't say always.

Yeah.

It reminds me of the same take. Is that like, who has the money? Who has the resources? Who owns much of this?

Yeah.

Well, it's the provider.

And the reason, right? So if you take a step back, the reason that is that way, we operate the banking businesses in 3 countries, right? Brazil, Mexico, and Colombia. We picked 3 of the biggest scamming countries in the world to operate inside of, right? If you think about it, it have very, very unique risks that we likely don't face as big in the US or in Europe, right? Like you have a terminology in Brazil, it's called express kidnappings. Now, like, just pause there for a minute and think about the old school days, like what a kidnapping was, right? Like, I'll engage, like, what was a kidnapping? What's your understanding of a kidnapping, Tim?

Like, I'm picturing like Lindbergh baby now.

Yeah.

White van and like somebody being shoved into it and physical kidnapping.

Yes. And what do they do? They kidnap them for what?

Ransom.

Yeah.

Money.

Yeah. Right. They want money. And why did they kidnap him, do you think?

Because they wanted money and the person, their parents had money.

Yeah. And it took a while to get money, right? Back in the day, if you wanted a million bucks, like even today, if you go to the bank, you want to withdraw cash for a million bucks, it takes a while, right?

Yeah.

And so you had to hold the hostage for a bit. You had to show a picture, you had to show who they were, et cetera, to get the money and—

Hold up today's newspaper. Yeah.

Right. Like all of the, all of those things. Why do we call it express kidnapping? Well, a few years ago, I don't know if you know this, Brazil has one of the biggest instant money transfer systems in the world sponsored by BSN called Pix. And so you can imagine, so now you can do instant transfers of money. It's free to do. It doesn't cost you anything. It's like Zelle on steroids, super secure and sponsored and the likes. But you can imagine the first few years how much fraud is going to happen inside of that. Well, guess what it does now? The reason it's called express kidnapping is they grab you and it's now a mugging. I would, You'd equate it more with a mugging. They're going to grab you, but they know that a high percentage of the population has this Pix capability. So they're going to hold you either at gunpoint or whatever and just say, just transfer money into my account, and they'll let you go. That's an express kidnapping.

Wow. Wow.

I opened my mouth to say something involving the word fun, and I decided to shut up because it's anything but. Yeah, that's horrible. I'll be honest with you. It's anything but.

Yeah.

But I can see why it's a scary crime that can only work Yes. If this type of easy, instantaneous transfer is available.

Irreversible.

It's almost like ransomware and Bitcoin. It's kind of the same thing, right? Well, in this case, yeah, it's the instant transfer plus kidnapping is like a perfect together.

Yeah.

It's not irrecoverable. I mean, you can recover it, right? So this is where— so the reason I tell the story is not to— and by the way, people, go visit Brazil. It's a beautiful place. It's not— yes, I'm using this to tell the stories, but Yeah. But because of that, like, because your question was about what's different, we have to have solutions. What happens to our customer if that happens to them? How do we take care of them to make sure we can help get their money back, right? So that's the point inside of that. How do we detect true express kidnappings versus like pretend ones for fraud mechanism and the likes, right? So that's where I'm going with the story, is to kind of highlight some of those Differences when you're operating in different parts of the world. And it's fascinating.

So you didn't have to worry about that when you were considering whether somebody's Spotify Wrapped got messed up.

That's right. We had different reasons. We had a different type of scenario, a bot, right? So artificial streaming was a big deal back in those days. But here, it's a little different. And look, Spotify, fantastic. We had a lot of big challenges. But the reality was that wasn't people's life savings. It wasn't what they used to pay their mortgages. It wasn't what they used to eat, right? And that's what— We see today that's what we're literally doing, and that's what we have to protect. So money lost, whether it's from express kidnapping, whether it's from malware on a device— because we're only at mobile devices, right?— all those things will affect our customers. And so we have to take a very in-depth and proactive approach around that.

That reminds me of some other stories I've heard from people who do security because it's not just a passion project because the challenges are fun. but because they're kind of, and I mean, pause for drama, kind of saving the world, saving real people. I think it reminds me of the Bob Blakely episode when he said that ransomware brought cybercrime to non-IT domain. And I think what Dave is, I'm getting the same vibe, is that it saves, quote unquote, normal people's lives as opposed to like IT stuff inside IT things. Am I overdramatizing this a little bit? I tend to.

No, I don't think so because like, and here's why, and here's why. Maybe it's not for everybody, but there's also a nuance you know about Nubank. We are online anywhere, only online. So we have no alternative. Our solution cannot be go to our branch and we're going to help you, right?

Mm-hmm.

So you're not exaggerating it for us. Like, so everything we think about, the solution has to be either like— so the only way you're doing your financial traction, financial true transactions is in a mobile app. We have a web app, but it's really for like reporting something like this. Or revoking access, et cetera. You're not doing your financial transactions in a web app. And so everything that we do really is seen like from a technology perspective. And so we have a saying like every business problem is a tech problem and vice versa, right? And so we really have to focus on that and look for— I think we have to look deeper than a lot of our competitors because we simply don't have that option of just go to the branch. We just don't have it. Doesn't exist.

So I almost feel like this can continue because I'm getting even more motivated to talk about this, but I want to switch it back to the name, to the one word in the podcast name, namely Cloud Security Podcast.

Oh, really? This was like really fun though. Like we could have had a whole episode not talking about cloud for a change.

I know, but I'm going to pull the cloud card.

Ah, all right, Anton, pull it.

And it's the weird one because our initial question was kind of about what are the key challenges you face in your cloud operation, which of course is a very generic, safe question. But I also feel like maybe if you can add a time machine angle to it, like if you can transport yourself back in your previous CISO stint days and think about what you wished you knew. And this is like a kind of an auxiliary to the question, not only what are the challenges and lessons, but what lessons you wished you knew.

Yeah, it would be, I'm going to take a step back. We're a very big engineering company too, just like Google, which is at Spotify over at Nubank. And one thing that we did, we drove, you know, it's a service architecture, right? And we're highly organized for squads to go out there and move fast and quickly and lots of them, right? That's how we're able to keep delivering what we're doing. With that though, you know that there's a trade-off if you're organized for high autonomy and small services.

Mm-hmm.

The trade-off is that as you grow, you're gonna have more and more of those, and you're gonna have a lot of overhead in communication, people knowing what they're doing, et cetera. And so it's like, it's a different answer than maybe what you were expecting, but I would really focus more on the organization and what silos you tend to not directly create and enforce by having so many niche teams focused on security. That's one area that I would go back and saying, you know, I get that we need specialized skill sets, but having so many special teams makes it very hard for the connective tissue to be really good. Now we're focused a lot on how do we solve that problem and get people to do things right. As an example, you don't do threat intel just to do threat intel. You don't do threat hunting just to do threat hunting. And this will come into the next wave of the SOC too, right? You're doing them for a purpose.

Yeah.

And often, if you ask companies what are they doing, you will see more complexity in what they're doing that is driven by how they're organized.

Yes.

Yes. I love it. And it's almost like I don't want to— it probably reminds you, well, it should remind you of your job you had here, I guess, right? Because sometimes when you see the transformation projects, they stumble not at kill old SIEM, buy new SIEM, or hire a consultant to refine the process, but the projects die on the team side, is that they never turn their team from the quote unquote the '90s approach to the modern approach. And I think that still speaks to me as a team centrality for these efforts.

No, absolutely. And you'll see it too. Like, they'll get great new tools, but they'll try to put their existing processes automated inside of that tool, right? You're like, what?

Why?

Why are we doing this?

Yeah, I used to be really cynical about like business transformation, but the more I've seen teams struggle to adopt tooling because of team cultural issues, the more I think, geez, that's a really hard problem in there.

It is.

It's an area where Hofstadter's Law applies, especially, you know, Hofstadter's Law, everything takes longer than you think it will, even when you take into account Hofstadter's Law. It's true for cultural transformation, especially.

Even more so, cultural is one of the hardest ones, right? And I think it's underestimated. As you talk about like, how do you make a change inside? And that's probably the second part is, look, when I was younger in the field, I look back at— I had these beautiful like, this year, here's everything we're going to do. And then over the next 2, and we're going to like do all these things and we're going to drop the risk down by this amount. And we were just gung-ho. And boy, oh boy, were we wrong because we weren't wrong about what we were doing.

Yeah.

We were wrong in the estimation of how impactful that would be to the organization because it was a cultural change, right?

Yeah.

So, we may have gotten the thing done, but did we get the outcome that we were expecting? And the answer, if I look back, almost all the time was no because we were measuring it too early.

Oh.

But by getting that done, we were now just about to be able to measure the impact of that cultural change.

That pays for the price of a ticket to the podcast on its own, by the way. I feel like this is the gem that I wish people knew. And I think that the time machine approach is probably what elicited this, right? Because if you travel back to your super early days of your first CISO effort, probably that on a nice printout would have helped you. Yeah. Yeah. Or maybe you wouldn't have believed it, by the way.

Probably not.

Maybe you'd be like, oh, yeah, Dave from the future sent this. What kind of BS is this?

It would be an interesting conversation for sure.

I really like this time machine question style way better than Anton's other 3 AM time.

Yeah, but it's a different paradigm. At this point, we are not trying to elicit quick instant truth. We are trying to elicit sort of time-learned lessons. Like, these are 2 different tools.

No, this is a much better paradigm.

Okay.

This is great.

Thank you.

So I want to switch gears a little bit and stay on the cloud track for a little bit longer since Anton put us there. And I want to ask about metrics. You know, we were just talking about measuring too early. Well, when it comes to cloud, what do you measure? How do you know from a metrics standpoint that your cloud environments are secure?

Well, look, I think, you know, that's a tough question, right?

Yeah.

It's a really—

Long one too.

And it's long.

Leave it to 6 hours. Leave it to 5 to 6 hours.

And so, but there are techniques to get there.

Yeah.

And I think it's going to be different for everybody. But I think it really understands with you first being able to articulate your risk inside of the cloud from a security perspective, right? And that's really easy to say, but what does that actually mean? So if you think about cloud security, and I believe I said this previously, like there's just a few things that really, really drive security in the cloud. And like the first one is probably the most important, right? And that's identity and access management. It literally is security in the cloud.

Right?

Who and what has access to what, right? That's it. Systems get their permissions that way. You create your borders that way. Like everything, just about everything that you can control as a consumer of a CSP is through IAM. And so it's interesting that that's probably where you have the least telling dashboards that come from the CSPs themselves, right?

Mm-hmm.

To me, it's the interesting part of the— okay, If that first part is true, what I said, then I would expect amazing visibility across the board, and I would expect that from the cloud providers, all of them. Guess what? We don't have it.

You don't get that.

You don't get it.

No, you don't get that.

I'm shocked.

Reality wins over a good logical argument, right?

Yeah. So, in lieu of that, we have to do it ourselves, and we have to say, okay, here are the things that are important to us, and it will change across the board, but here's what I'm concerned with. I am concerned with number one. So it's both identity access management and I'm looking at the configuration. So I am very concerned because we're very lucky. What do I mean by that? Like I said, we— our customers interact with us on mobile devices. I do not need hardly any services that are open to the internet for my business to operate.

Hmm.

Right. So that's a driver for me. I want to make sure that that is a true statement that we don't have that across the board. We can do that many ways. We can look for default settings. We can look for manual overrides.

Buy a firewall appliance.

Yeah. Oh, wait, did you say buy a firewall? Oh, no, we're not going to do that.

Anton, Anton, you have to go sit in the corner and think about what you said.

I was delayed that you said appliance. Like, no, no, no. Right.

And so there's a little bit— That was such an off-the-wall idea that Dave couldn't even process it.

Oh my gosh. So that's one right now.

That's what I thought.

So we know that the status for us is that we don't need that. So therefore, we shouldn't have that except for rare instances. So that's a good metric for us to look about in what we're doing, right?

Hmm.

It's a luxury we have. I say not everybody has that. I think the second thing I'm looking for is, you know, we have similar to others as an example, our golden images. So it's like, what percentage of our fleet is actually inside of those golden images? That's a big driver for us. But why? That's a proxy for our configurations. That's a proxy for a whole bunch of things that are baked inside of that. And I don't have to have a bunch of alerting around that. They can get noisy. I can simply look for, where are we? Same with vulnerability management, right? That's another, another thing. How are we, how are we driving? That can also be driven by our golden images and where are we? Are we on the rev minus 1, whatever we're looking for to do, et cetera.

Yeah.

out there. Those are some of the bigger ones. And then I'm also looking for all of the variants, right? So we're in multi-clouds. We're primarily in one, but we are in multi-clouds through acquisitions, through partnerships, et cetera. And so I'm also looking at how many variants do we have out there, and we're paying special attention around that, right? So I'm not giving you a whole bunch of the exact metrics that we look at.

No, no, no, but that's good. And I mean, maybe this is the way to apply the other— my other favorite question, namely the 3 AM question, That if somebody wakes you up at 3 AM and says, how do you know your cloud use is secure? Like, you would probably refer back to some of the things you said, but like, would there be some kind of a short and pithy version of how do you know that your multi-cloud use is as secure as you want it to be? Actually, maybe that's a better question because secure is—

yeah.

Yeah. What goes is— yeah.

Yeah.

It's a good question.

Look, at the end of the day, that's something we're working towards, right? Which is, you know, same philosophies. We put controls in place. How do we know that— you're effectively asking me, how do we know that they're working, right?

Mm-hmm.

It's another way to ask the same question. And we're constantly driving at that to make sure we're having continuous control monitoring. Our objective is to make sure every control we have, that there is a monitor on it and that we can detect when they fail and when they're not working. Because it might not fail, but when it's not working as intended either, and that's harder to do, right? Some people will skip that second few. So It's there is one thing. Is it there and are you getting the outcome that you expect it to be doing is a tougher question to answer.

Can I pick at something in there?

Yeah.

Because I hear this from a lot of CISOs and security directors, gold images, baking our config. How do you get teams to work with you on that? How do you keep engineering teams from running off and saying, no, no, I need this Snowflake, no, no, I need to do this thing?

Yeah, it's hard. I'll give you 2 answers. We have a very limited tech stack.

Hmm.

So we're very lucky. There were some great architectural decisions made. And like, look, we have a very, very limited— for the vast majority, it's public out there. For the mass majority of what we do, it's a very simple stack, right? Clojure is our language. The database is Datomic, and it runs on K8s. That's it, right? So that's the vast majority of it. So it's there. And look, I don't try to force people to— people want to be on the most well-maintained image, right? It's not about security. It's about operational excellence, right? We're just part of that. If you think about it, do you have the right patches? Do you have the right versions, et cetera, et cetera, out there? So we just hop onto that train where like, that's what people want. They don't want to have to keep doing subpatches and the likes there. Now look, it's a journey for us too. It's what we're trying to get to, to maintain out there. But that's the way of thinking about it.

Oh, yeah.

Right. So having a limited stack is absolutely— now, again, it's the vast majority. We have outliers. But again, then I can look at my invariants or variance. So it's helpful. That is a luxury that most people don't have. Right.

I love that answer because one, it really feels like you recognize the places where you are indeed lucky, but also it speaks to the value of simplicity.

Yes.

For security. And Anton, what episode did we talk about this in? Or is it like every episode is a subplot where just simplicity is how you succeed at limiting your scope for problems to even arise, let alone having to solve them.

I think it comes up, but it most often comes up as an example of useful, great, and absolutely impractical advice.

Yeah.

Because somebody shows up and says, but I want to run SQL Server on Windows in the cloud. And people are like, snort their coffee and all that, but it doesn't really make some teams stop. And as a result, I think that's the angle that they miss, is that the simplicity helps security. Sure, we all agree. But what do you actually do when people show up with complex, over-engineered, insecure decisions, solutions, architectures, and say, hey, we plan to use this?

Yeah. And look, we have an ethos on it too. It's like, we want the— I truly believe complexity is terrible for operational like stability, and that equates to security stability also, right? So for me, it's a root cause of a lot of issues. And we see it goes back to what I talked about earlier about complexity in the organization drives complexity in tooling, drives complexity inside of like, like, why are you solving for teams that aren't talking to each other when they literally should be working together like every single day, right? Like, so how do you solve that with a tool and you engineer it out, or do you solve that as a people issue, as an example? Right. And how things are organized. Yeah, it's very interesting. But so I'm asking the team now, anything that new we're going to put in, what can we take out?

Yeah.

Okay. So if somebody says, okay, so I can see where this also squashes all the snowflake, not the database, but these sort of like unique, rare, handmade artisan choices.

Yeah.

end up being suppressed for good reasons, namely that, well, would you rather make this silly strange choice or would you rather go with the mainstream idea of X, which worked well for us? Like, and people are like, yeah, I don't know, maybe my project is not that special. And suddenly they approach in a simple manner. I mean, maybe I'm oversimplifying it.

I don't think you're oversimplifying the concept that like making that happen is the complicated part, right? People are complicated.

People are complicated. We're getting towards the end of our time, and I want to sneak in one question, which is only mildly self-serving, which is to ask, surely it's not because you're a former Googler, but I heard a rumor that you selected Google SecOps for your DNR. Could you tell us about that?

Yeah, look, a couple of things. Yeah, I'll say that I am, but look, the team chose it. I stayed out of it.

Really? Nice.

I stayed out of it. Absolutely. Why? I'm not using it.

Why did the team choose it?

Look, we can, we can talk into it. It met their needs, right? So it met the needs of what they were trying to accomplish, which was you know, being able to ingest more, to connect it with the threat intelligence, right? To get better understanding of what those particular issues are, because it only gets more complicated for us. And they felt that from their requirements, it was the best tooling for them, right? I stayed out of it. Why? I'm not the one that's going to use it day to day. So what, what does my say have to do with it? Now, I will go through it from a financial perspective.

Yep.

I'll go through it from making sure that we have partnerships and the likes inside of that. But End of the day, you know, we— I have to empower the teams to make the right decisions for them, but hold them accountable for making sure that they're thinking through the problem holistically, not just from a narrow perspective.

But does it mean that all those salespeople who try to impress the CISO with the same UX are delusional?

Well, I don't know, because I don't know if every CISO does that, right?

No, I think we're talking to a fairly enlightened CISO here, Anton.

I think that's I think that Phil said the same thing a few times. It's like, why are you trying to focus this story on CISOs? CISOs don't do that. Their teams do.

That's right.

But there are definitely people who don't have ears for that message.

No, it's true. Look, somebody sends me a note, I'm saying, hey, I'll connect you to the team that's working on that, right? Like, that's my role inside. Now, my role is to hold those teams so they understand what the objective is and how I'm going to hold them accountable to it. If that's true, then they should be empowered to pick what they need in order to meet those objectives, right?

That actually makes sense.

I do like nice UIs, though.

I mean, there's no debate that you want this big, big red button that says make a board report. And when you push the button, the report just gets generated and emailed to the board automatically, right? That's what you're talking about.

No, I'll just take nice dashboards on IAM GCP.

Oh yeah, IAM pretty much wins Every real popularity contest is always won by IAM by default because IAM can block access to the competition.

Exactly.

That's an IAM joke, Tim. Please laugh.

Anton, you have to ask the traditional questions today.

Okay, I'll ask the traditional closing questions. So we're kind of at time. So while this was really fun, we get to finish with something. And we usually finish with 2 things. One resource, reading. It can be the book, can be the blog, can be anything. It cannot be my blog, as Tim always points out. And the second is one tip. And I think in this case, maybe the tip is— what should we ask for the tip on? How to keep cloud secure? How to keep your environment secure? I'm actually at a loss because—

Yeah, maybe how to know that your cloud is secure.

So the tip on that. Yeah.

And recommended reading.

Okay. So the tip on how to know your cloud is secure. Who's the tip for?

Oh, okay. CISOs and teams. Excellent question. I would say CISOs and teams.

CISOs and teams. Okay, so I think CISOs, to know that, they're like, they're gonna have to get there, roll up their sleeves, and understand how cloud works so they can ask the right questions and then see it for themselves, right? Like, uh, that's the tip. Make sure you thoroughly understand what your team is reporting back into you. And it's not because you don't trust your teams, but I would suggest seeing in its native state. So show me the— let's log in, right? Let's go look at it. Let me see it so I can truly understand it. Don't ask them to, you know, like you can eventually get to some nice dashboards where you don't have to do that, but get in there, dig in, ask a lot of questions about what this means, why they made those decisions. I think that's the tip. A good reading, you know, I think today I'm obsessed a little bit about anything. I'm not gonna give you a particular one because there's a lot of articles out there, but it's really about how to get people to understand that they can be leaders without the title. Hmm.

Hmm.

And so anything that you can put out there with your teams, blogs, books, whatever's out there, just because what you want to encourage is ownership and people knowing that if you see a problem, spend the time, come up with solutions. And if you truly, truly, truly believe that it's important, never give up on it, right? I don't care. It's the opposite of the sales side. How many times are you going to say no, no, no? But like, you never give up if it's that important. Right? So anything that's helping your teams learn more about that, how to write more effectively to raise those issues, I think they're super, super important for folks. I know this is probably not what you were expecting, but it is what it is.

That's a great answer though. I love that.

I think it's a great answer. And I think that it's missing in many cases. Like it's this hole in the middle of the donut for cultural transformation or team transformation is that people assume, I mean, it's, I made jokes about it that everybody wants to transform as long as his team stays the same, but everybody else around him is modern.

Yeah.

And it's like, that fixes it. That fixes it.

That fixes the bug. Yeah. And I think there was a book, right? Like Slow Thinking. And now there's a newer one, like Thinking Fast and Slow. So it's a book I wonder— it's on my list.

Okay.

But that's a book that I don't know how good it is. I haven't read it yet, but I liked the first. And combining them seems interesting because it's a lot about what I'm saying. Like, you have to be able to think and make quick decisions, but you also have to be able to think slow, understand like the complexities And what the implications of are some of the changes. And the more— like, I have a different viewpoint. The less that I contribute to an RFC or to a document, the better. That means the teams are highly effective. I take no pride in jumping inside of there and putting comments and etc., etc. I would love to just be like, this is fantastic work, and like, I have no comments, no notes for you, right? Like they say on all the, all of the singing shows, I have no notes for you, right?

Your answer here reminds me of a book. Can I recommend a book, Anton? Yeah, it's your show. It reminds me very much much of the book Turn the Ship Around, which is written by a sub captain on how he turned around underperforming submarines, which turns out is very important to not have submarines underperform.

Yeah, that would be awful.

Yeah. So listeners, if the leadership and ownership stuff resonated with you, check out Turn the Ship Around as well. Dave, thank you so much for joining us once again on the show. What a pleasure. What interesting problems you have in South America and truly how lucky we are to have you and your constraints join us Thank you for having me on.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at @antonchuvakin and @dylanharris. Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.