EP229 Beyond the Hype: Debunking Cloud Breach Myths (and What DBIR Says Now)

Security running.

Hi there. Welcome to Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the Senior PM for Detection Platform, UEBA, and Risk in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we have a guest joining us today that we have wanted to join us for so long that our questions for him actually went stale because they referenced a breach so long ago none of the 3 of us could remember the details.

Yes, this is actually kind of a funny and sad story at the same time. Ultimately, this was a really good idea to interview him back then.

And it was still a good idea.

It was still a really good idea to interview him this time. We met him at RSA, and this is recorded at RSA. And to me, this is a very fun episode. It's a useful episode, but it's also a very fun episode because you would see the energy of us being in person on kind of on a little stage in the studio.

So we were in fine form.

And there would be a video that you can watch.

By the way, there is also a video to watch. So maybe because this guest needs no introduction, this topic needs no introduction. Let's turn things over to today's guest.

Okay. Are we live?

Yes, we are.

Nice.

Are you supposed to say, is this thing on?

Is this thing on?

We are on air. And moreover, Tim, we are 2 minutes early today, which we've never done in our lives.

We've never been early in our lives.

So I want to reflect on that fact. How come we are early, not late?

Why are we early?

We are, dramatic pause, well prepared this time.

It only took us 4 years to become well prepared.

One time.

Once.

We're going to go back normal after this.

Okay.

Don't get used to it, listeners.

I like to think it's more like positive influence being—

It must be the guest.

It must be the guest.

Listeners, we are so lucky today. Today, we are joined by Alex Pinto, who is the Associate Director of Threat Intelligence. But what that really means is that he leads the Verizon Data Breach Investigations Report team. And listeners, unless you live under some kind of cyber rock, surely you are familiar with the Verizon Data Breach Investigations Report. We've wanted to have you on the show for years now. So happy you've finally been able to join us. Of course.

It's, I mean, just got, you guys got prepared, so I showed up. See, that's the secret.

Oh, that's the correlation, not causation.

Which, which, was it Ben Franklin or Thomas Jefferson who said, I am I'm a firm believer in luck. The more prepared I am, the more I have of it.

Something of the sort, yes. I'm pretty sure you can Google it, Gemini.

Yeah, yeah, Gemini can get the correct quote for us. So, I think we're about ready to get going here, and why don't we kick things off with our first question? Since we are the Cloud Security Podcast, I'm obligated to ask this question, which is, how would you define a cloud breach? Is that a real thing? Is it a different thing? Is it a breach that happens in the cloud? What is a cloud bridge?

Well, Tim, I guess I would start that by asking you, what is a cloud?

Oh, no.

No, no, no, no, no. We have to make a short disclaimer about, like, cloud is not just somebody else's computer.

Not just somebody else's computer.

This is a good opportunity for us to remind people that cloud is not— I'm gonna do a finger wagging thing.

I'm gonna try.

Cloud is not just somebody else's computer.

Did it work?

Yeah, it's pretty good. I like the finger wagging.

Oh, yeah.

That's fantastic. So, that's what cloud is.

It's not just someone else's computer.

So, I guess a cloud breach can be many different things, right? Depending on what's the type of cloud, right? I'm not going to— going back to the basics, right? Is this a SaaS, right? This is a software as a service. This is a platform as a service, a PaaS, or infrastructure as a service, right? Each one of these, you're abstracting different layers. And so, there's different ways where an organization can mess up or be confused on what the security boundaries really are, right?

Hmm.

And that's where you kind of open the opportunity for things like that. to happen, right? So, I mean, way more than when we first conceptualized this webcast like 3 years ago.

A long time ago.

And this was the question that was in that one. Cloud is much more, even much more a part of everybody, every organization's life than it was before, right? So, maybe a cloud breach is just a breach now, right?

That's very island peninsula thinking, right? If cloud is just, cloud is kind of computers or IT.

Yeah. I think it's more, I think, you know, we would be hard-pressed to find an organization that does not use the cloud in some way.

Including SaaS, basically. Yeah, correct. If you say cloud includes SaaS and find an org that does not use cloud at all, it's gonna be really hard. Even the hardcore cloud skeptics, maybe not haters, would probably use a SaaS or 2 somewhere.

Yeah, somewhere.

You guys should consider just renaming yourselves the Security Podcast. You know?

Oh, no, no, no. We like our cloud scope.

That's fair enough. That's fair enough.

But back to cloud breach question. When you take a naive take on this, you talk to people, they sort of assume that it's just leaked creds and keys and there's not much hacking going on. People just basically go to your GitHub, go through your PHP code. PHP code, yes.

It could be Boris, could be Pearl.

Could be yours.

And then find the credentials and just log in. Is it reductive or is this largely the truth based on your data?

I think that's definitely the most common thing, right? You are— there is any engagement in the cloud, right? In your, okay, I'm hiring a cloud to help me with this deployment or this part of my business, right? You are mitigating, not even mitigating, kind of transferring the risk in a way, right? And so, you definitely want to believe, and I think that is the general truth for most of the platform infrastructure, infrastructure as a service, right? Where, okay, people are not just gonna break on those machines there, right? And no one's gonna force their way into the data center or do some physical breach.

Let's hope not.

So, yes, let's hope not. So, you get a lot of guarantees, right? But then really, like what I mentioned before, the squishy parts become your interface with that cloud service, right? And the most common way of interfacing with those, I would say, I mean, I'm not gonna make a Too much of a general statement, but it ends up being an API key, credentials, or something like that, right? So, that's definitely the most frequent kind of thing we're gonna find when we're trying to— I was talking to someone, I know you're gonna bring it up, all the things that happened around Snowflake, right? I was talking to—

I wasn't sure I was gonna name them, but sure.

I name it, I name it.

Yeah, you named the name in your report this year. That's different.

Yeah. No, ever since, look, I think it was really silly when SolarWinds happened and we were kind of stepping around it, right?

The well-known network device management company or something.

But however, yeah, there was, I don't remember the exact joke. There was like rhymes with such and such, right? Yeah, it was anyway, the point being, look, of course it is, Things happened, right? And it's important to kind of be able to give it as an example, not as an example as, oh, they should be, but no, because I think they did almost everything right. That's kind of the interesting take here, right?

That's a spicy take.

That is a bit of a spicy take. Did the customers though?

Here's the thing, right? I was talking to someone about this, right? And you're sorry. Okay. What does the breach like? So they were telling me that they actually like understanding how Snowflake set up, they put so much effort in like really segmenting and making sure like the virtual environments were. I mean, there was no chance by design architecture that the data would leak between customers. They did such amazing work. But then, oh, well, I guess we didn't quite enforce MFA, or it was fairly easy to disable MFA in some scenarios, right? And that's kind of what happened there. And so, it was credential-driven, but it was— the thing I think it's important for folks to understand, there was no material weakness in the way Snowflake was operating. Right? And should everybody be enforcing MFA? 100%. That's the first thing they turned on. And I hope everybody got the message.

Yeah.

MFA now.

Yeah.

On their environments, right? But what I'm trying to say is that there is a degree of luck here, or unluck, if you think about it.

Oh, I'm sure there is.

As in, okay, we got all these credentials from all these services over years and years and years and years of an info stealer operation. Right. And so which one are we going to pick today to bother? Oh, look at all these Netflix creds here. Let's build the tooling. Let's build a way to spray those passwords. Right. And it's what you got. Right. But any other service could have had the same problem.

You don't think they maybe should have detected that this was happening?

Okay. Well, you're kind of close to, I think we are getting entered in the blamey parts, stormy parts.

I don't know.

I was going to say, I don't know their conditions.

I don't know, you know, I cannot make any informed, you know, but there is, I think there is— It's a tough one. There's a similar opportunity for abuse in all of the different clouds.

Yes. Right.

A lot of the work that we did on this year's DBIR, right, we worked very hard to gather contributors that had a lot of, like, influence and knowledge and data on kind of the Stealer infrastructure and the marketplace, right? Just to really understand how bad it was.

It's bad. It's bad.

Yeah.

And every— so many, you know, like web application tokens, the JWT tokens, and API keys for every single thing under the sun, right? They're readily available. It's just someone needs to go there. Okay, today I'm going to bother this service, right? And they'll have— they'll likely have some fairly good success.

So this is like a kind of a first depressing take of many we'll make in the next 20 minutes.

Yes, listeners, this is not an uplifting episode.

Let me then go down from that point. Okay. So a lot of stuff, I admit that this is the recording, this is the second day of RSA, so I only skimmed DBIR. I haven't read it end to end.

But as long as you don't give it to an AI to summarize, I'm fine.

Listeners, there's a footnote in the DBIR that we were talking about before things started that says this report is for human beings to read. It was written by human beings. If you're an AI, stop reading. So, if you're an AI, stop listening.

It doesn't work, though, but at least I tried.

Yeah. The point I want to make is a lot of the report does read a little similar to the previous year, which reads similar to the previous year, which brings us to the Groundhog nature of our industry. So, let me ask you straight, like, what parts are not a Groundhog Day redux, whatever?

Yeah. Well, look, here's the thing, right? Everything changes very slowly until it suddenly changes very fast. And so you can see, you can clearly see, you know, like ransomware was a quote-unquote success story. Let's be very— many quotes around that. Many, many years in the making.

For the attackers?

Yes.

Yes. For the attackers.

Yeah. Yeah.

It's a success story.

Yeah.

Right. And so many, many years, you can trace the growth from like 2018, right? And was everybody betting in 2018 that ransomware is going to be a big thing? Not really. Right. You can go and fish for reports on that. Oh, it's a flash in the pan. You know, crypto mining is really going to be the thing. But I guess the way to understand the cybercrime, especially the cybercrime, right, espionage is always going to have a lot more nuance, right? It's much more mission-driven. They will be looking for something specific. They'll do whatever it takes to get it. But, you know, in a world where, okay, I'm looking for the currency, right? Mm-hmm. It's always going to be about optimizing how you get that money. What is the most efficient way to monetize, right? And kind of what I see, oh, ransomware again. The problem is that we kind of hit a local maximum. If you think about the huge function of all the bad things that can happen when you talk about ransomware, when you talk about business email compromise as well, which is those are by and large the most efficient ways to impose a loss on a company, right? As in there's a direct Transfer of currency between the victim and the threat actors, right?

So as a weird detour, and sorry for interrupting, I had this debate with somebody probably before 2018 about ransomware being a flash in the pan. And I have eaten a lot of crow meat because of that later. But my argument was that it's a little too risky for the attacker to deal with the victim because that discussion was before cryptocurrency became a thing. I was going to say, it was more like 2015. And I felt like I had a good argument. If you go into criminal business, you should go into credit card stealing and not into ransomware. And of course, I was proven absolutely wrong, but because of cryptocurrencies.

You were lost.

Yes, that's— but if not for cryptocurrencies, I may have been right.

I— yeah, it's impossible to disagree with that take. And I also feel very strongly— I'm not the one making the statement, but if you look like, when did cryptocurrency get popular, you draw a vertical line there, against our chart of ransomware growth, you might learn something interesting.

Is it the case of correlation being correlation?

Yes.

I'm very unpopular at Thanksgiving dinners in San Francisco because I will tell you how much I hate cryptocurrency.

I mean, it's a really good tool for ransomware support.

It's a great tool for ransomware support. It's a great tool for money laundering. It's a great tool for stealing retirement savings from old people. It's awesome. We love cryptocurrency.

For these reasons.

For these reasons.

But to get back to your question, right? If you think about the outcomes, the kind of the ends, right? They haven't been changing much over the past few years, right? It's going to be BEC, it's going to be ransomware. We didn't quite run the numbers this year, but last year we had a— for last year's report, we had like, like 2/3 were Ransomware, financially motivated, 2/3 were ransomware.

Wow.

And a 4th was BEC. There's not a lot left, man, if you do the fraction math, you know.

BEC leading to people transferring money.

Correct.

Yeah. That's kind of—

Business email compromise, just for the audience, business email compromise leading to somebody voluntarily transferring money to the criminals.

Yeah.

Like that BEC leading to that.

Correct. And there's even like, even a step before that, right? Just the pure pretexting, right? You didn't even compromise somebody's email. You just like literally pretended CEO at CEO at company at Google, you know, not at Gmail. I mean, but you know what I mean, right?

But is it like dear CEO, please send me money criminal? Yeah, sure.

I mean, it's more subtle than that. It's you know we're your supplier. We changed our banking partner. Please send it here.

Yes, I understand. But is it like a very well you promised the present takes so they look look no no no no look you have to you have to understand.

There's a lot of companies out there. There's a huge spectrum of security maturity. There's a huge spectrum of being able to pay attention. And again, we're going to try to get away a little bit from the victim blaming, even though some of these things, they seem really stupid. It's not stupid, right? Exactly.

We are the high-trust society, back to Bruce Schneier's book, right?

Yeah. But anyway, but the thing that changes, the interesting thing is like, The ends are the same, but what about the means, right? What about the ways that those things start? And again, one significant thing we've seen over the past couple of years, right, has been we've always had credential abuse as number one, right? Indisputable, right? It was always on the top of the chart where you can see really a resurgence, a really focus on exploitation of vulnerabilities now as the way to get in and to do this.

That's interesting. Tell us about that. What's driving that? Because—

I'm trying to agree with that. Yeah.

Yeah. So why is vuln/exploit up? What's going on with that?

I know.

I mean, let me take a step back.

If you don't know, nobody knows. No.

So this goes into investigating the mystique of the attacker. What are the intentions, right? Why would they be shifting tactics like that?

Yeah.

It's something that we— I mean, everybody has observed this, right? We saw the huge growth in things like the file server-like vulnerabilities in 2023, like MOVEit as an example, and a lot of other ones we named.

But this VPN now is a complete laughingstock. Like VPN appliance, if you hear VPN appliance, you assume it's hacked. But it's like a depressing take of the day.

Why are VPN appliances so hackable? They're exposed to the internet. They don't get rebooted. They don't run EDR. They don't get updated.

All this is there, but the software Server last updated in 2014 should not be on that list.

I mean, I don't like to, you know, I— but it's interesting to see how the thought process evolves, right? Because we were looking at things like moving to SQL Server, and a lot of people were— and we did the analysis as well— we're not patching these things quite fast enough. And then folks, yeah, but you don't need to, right? This should be behind a firewall. You don't want to put it facing the internet. And then what do you know? Now everything is about the things that are facing the internet, right? And so, I mean, there are people who are way more in tune with the kind of the threat actor mindset. What are they doing? Right? Even like some covert operation understanding. Right? I mean, I think those they are just like focusing on developing of zero days now. Right? Just the capability that we for a long time there was absolutely no doubt that you know nation state level attackers would have and they would be investing a lot of money in this. Right? You know, it's a new day for cybercrime. Cybercrime is Doing that too, and that's why they're being so successful. Right? Why do these all popping keep they keep popping up so quickly? And there some of them are like oh ransomware used first. These guys are the ones that did it. Right?

And so if you think about it, makes sense. Ransomware gangs have an R&D budget fueled by ransomware.

It's all small the Benjamins. Yeah.

So so back to ransomware. Are we at ransomware? Are we going to be here in twenty years? You need to be—

peak ransomware is too optimistic. Is ransomware as bad as it absolutely can be? Like, that's—

Oh, sure. Anton's asking, could ransomware get worse? I think the answer has to be yes, right?

Maybe. Maybe. I don't know. Look, look, look, I don't know what the ceiling looks like. I cannot describe it to you.

Ceiling of Madness, which is—

Yeah, yeah, yeah. I cannot describe what it looks like, right? If, again, if it's incredibly efficient, right? I think there's always going to be space for, for the, the straight up like fraud VC stuff, right? But it's just, again, it's too darn efficient, right? And, you know, there's going to be new flavors of it. We're going to find ways to counteract the ones that we have, right? But some way of You know what? I'm going to mess up your life. I'm going to mess up your organizational operations in exchange for some money. There's always going to be a version of that, right?

Always? Always.

I think always.

Like, what do you mean? Like ransomware 2045 is a thing?

Look, maybe it's not going to be the files on your computer. Maybe it's going to be like, okay, your AI double in your quantum pocket drive is not going to talk. It only replies to you in Hindu. unless you have 20 galactic bucks. You don't know how that's gonna— you know what I mean? There's someone messing up your life for money. I think there's always going to be a flavor of that.

I'm pretty sure that's one of those, uh, very recent episodes of Black Mirror that was effectively brain-implanted ransomware. Not to give spoilers.

Yeah, this is—

oh, it's very good. It's depressing.

It's depressing.

I think we reached—

are we at peak depressing take for this episode?

I don't know. Let's shift gears away from ransomware will be here for 20 more years and talk about something else that'll be here for 20 more years, which is AI. Okay. So how, how has AI changed the breach report other than giving us opportunities for, you know, for less money? Yeah.

Yeah. Yeah. So the—

did you write it with AI?

Absolutely not.

Absolutely not.

Absolutely not. And I mean that in the nicest way. What spell checker did you use?

We got you.

Look, actually, I have some very good copy editors, okay? Human copy editors as well.

Right, listeners, this is gotcha journalism at its finest.

I actually— it's funny you say that. I actually revolted at Gemini asking me too many questions. Do you want to summarize? You know what? I'm going to just turn the whole thing off. And then I turned the whole thing off and I wouldn't get spell-checked anymore. Sneaky bastard. Now I have to turn it back on because But anyway, sorry, that was not what you asked.

No, no. So, how is AI changing the report?

So, there's always been a fair amount of machine learning in the way that we build a report, right? So, a lot of the— we use it less than I would like to for like the data intake, right? But again, our experiments in kind of doing that at scale have had some very mixed results as of today. And it's more important to us to be right than to be fast, if that makes sense, right?

Yeah, it does make sense.

Someday, you know, it's going to get to the level where, you know, we're going to be comfortable enough, but that's not quite it. But once the data is ingested, right, there's a lot of processes we run just using, like, your more run-of-the-mill ML/AI, like clustering. When we talk about incident patterns on the report, that's all clustering. That's something we retrain every few years, right, to figure out, you know, what does system intrusion means versus what does social engineering mean in the context of the report, right? We also do a lot of— and again, this is nothing like LLM-driven, but it's like, okay, what were all the trends? We can calculate all the trends, right, from the data points, and then we can choose which ones we're going to talk to, which ones we're going to— The report over the past few years have been— it was a lot more like that, as in, The kind of the findings on the, on kind of the pure data layer were driving what was written. It's more something we have to do over the past few years is to make it more like case, like reality.

Reality-driven, yes.

In the sense that, oh, what am I gonna write on next year's report? Well, we're living it right now, right? I actually, I am writing about the past, so I know what happened in the past. So I know what I'm going to write about. Then it becomes the case of, do we have the data to talk about it intelligently? Do we have the data to deep dive where we need to deep dive, right? So, I mean, we obviously knew about the large-scale, like, credential abuse case, right? Well, and I'm not mentioning them right now. We knew about that, like, mid-year. And so I'm like, okay, guys, we really need to get a lot of folks with insight on InfoStealer because we really need to write about it. This is a big thing. people are interested in. They want to understand how bad the problem is, right? So there's a— I'd say there's a lot of like editorial newsroom energy. Oh yeah, right. Now, as in, not right now, as in, in this era of the report, right? To really try to— okay, these are the things that— these are the things that are going to come up. These are the things that people are going to— these are the things like boiling in the edge of people's perception of how good or bad it is. And we have the opportunity to make it tangible for them, to give them a number they can point to. Agree or disagree, as in, oh, this is simple good, this is simple bad. Okay, someone's taking a stand and someone's saying, okay, this is how you should think about this specific problem. But do you think that—

the question kind of was more AI-specific, but I'm going to wear a naive vendor hat and say that, do you think that you would see it in the data if any AI on the side of defenders is making an impact?

Ah, okay.

That's a good question.

That's a completely different question.

The reason I'm hiding from this, it has a risk of causing optimism.

Oh, can't have that on the show today. There's no optimism here.

So, it's not really on our remit to try to figure out how effective AI is in the defense side.

But you may see it in the data in some ultra-optimistic scenarios.

But this is back to the conversation we had with the MTrends people of like, he doesn't look at the successes, he only looks at the claims that fail.

Yes, that's kind of the same problem, right? I'm looking at the failure state. Right. And honestly, this is something I get this all the time in the sense that, oh, you have so much data, why can't you tell us what controls work better?

And look— That's the M-TRNS discussion we had, yes.

But look, from our perspective, right, because of the nature of the work that we do, it's all anonymized, right? I have defense deployment numbers, right? But it's— I don't know who the companies are. I have the breach. I don't know who the companies are. I can't put this together. I can't say, Oh, if you're using this control, you are X times less likely to be breached by that. It's all independent pockets, right?

So, you can't tell them because of the predominance of email breaches of this type, you should use this email security appliance and then learn that that's all they use and they still suffer breaches. Like, that's the risk that I see that if you can say, yeah, you should do X, and they're like, we all do X.

Exactly.

Why? Yeah. Yeah. Look, this is the holy grail of security measurement, right? And it's something that without— and I mean, I'm going to say the bad word here— without like regulation around— yes, I know this is not an officially sanctioned statement.

Let's take those. Let me try it again.

No, no, no, no, no, no. Let me try again. Let me try again. Unless there are proper—

the Tim Dirks episode.

Unless there are proper incentives for reporting, right? For, okay, maybe there's a safe harbor, maybe there are some advantages, maybe, you know, you're going to be fined this much. But if you report, if you give us like an FAA-level, NTOB-level report, you're fined this much, right? Because you're kind of quote unquote giving it back. Unless there are clear incentives for people to be forthcoming on why do the fail states happen, we are only guessing. Right. And that's a lot, again, of the security in the— let's go depress— you want to go depressing? That's a lot of the security industry today, right? Oh yeah, just buy my thing and that's going to solve your problems. There is no objective information about any of those things solving any problems. Maybe it's all luck. Maybe it's all luck. I don't know.

Not even firewalls?

Anton, please do not go so—

you know, that's the evidence that that's a cell reduces safety.

That's fair. That's fair. Okay, cool. All right. Sorry. I am sorry. There you have it.

Okay.

Okay.

Anton won with one example.

Anton won out of 2.

No. So, Anton, you have one more question, and then I'll close.

Yeah.

I want to— we talked about cloud breaches, but a very interesting angle that is inherently present in every cloud breach is, of course, shared responsibility. And in this snowy outtake about flakes in the beginning, there was a point about cloud breaches And in fault, I don't wanna go to fault, but I wanna go to what Gartner used to say, that most cloud breaches are customer fault. And I think that they optimistically estimated the percentage of breaches that are customer fault at a cool 99%.

Wow.

So, the line was born, as I recall, in 2015, '16, and it persists in Gartner research. And I feel like it has a good fact base behind it. So, does the report say anything about cloud breaches being caused by customer misconfiguration? Because they're certain nobody's hacking CSPs. It's very clear to me that in that sense, Gartner is right. It is not the platform that's being breached. We know it. The other 2 cloud guys know it. Maybe there's one cloud provider that gets hacked, but that's a separate story.

Okay.

Let me give you A spicy take.

Okay, spicy take.

Okay. And this is actually a research topic I'm actually very interested in, right? I've been— we've been partnering for next year with some, like, TPCRM guys, guys who do, like, evaluation of the cloud deployments and things like that. And I was thinking, what is the correlation about consumers, like, users of a cloud environment, making the correct configuration choices And how easy do the cloud providers, UI/UX, make it for them to make that choice? That's a great question. What is the guidance provided by the platforms themselves so that the best choices can be made? Right.

And so, you know, even stupid things are, do they charge a premium for certain security things, which then they turn around and say, oh yeah, we recommend you do X and X costs money.

Yeah. So yes, that's the best thing. All of this log, you know, you can send all the logs here, it's going to analyze everything for you. But by the way, it's $5 per log.

Exactly.

Right. And so, yeah, of course, there are— it uses resources. But, you know, you create a— it's an incentive for failure.

Yeah.

Right.

It's, in a sense, risk-taking.

But, yes.

Okay, fine.

It's a minor point.

You're right. Ignore me. Yes. But, you know, but you are assuming that every single person who's going to come through your door has the exact same risk appetite or even the exact same risk awareness.

Yes.

They might not realize, right? So, a lot of, oh, no, people should be free to make their choices. But what if they are not educated on what choices are good or bad, right?

It's not a free choice if you're not aware you're making it.

Yeah. I think that's right.

You know, would it be lovely to make this bucket public? But the UI now says, you're making the bucket public. Don't do that. That's a risk, right? And then people still do that.

Look, just how many of those public buckets you had before AWS made it that the default was private?

No, no. I'm more worried about the after. I know why people left them there from before. I don't understand how people do it today. Oh, because the nudging is clearly pointing the other way.

I'm excited for this research.

I think this is super exciting.

I want to see your results. I wanna see where we—

Are you looking Mostly at the big three, or you also look at some of the SaaS as well?

Mostly the big three. We have more, but something that was fascinating. You know what motivated this? And it's a shout out to one of our data contributors as well. God, I'm gonna say the wrong one. I don't remember which one published this report. You put it in poll. You put it on the notes when I read. I'm not gonna say the wrong one. I don't want them to get mad at me. But there was one which was like it was cyber insurance, and it said. Claims per cloud platform. So, they found it was X amount more likely if you're using this platform and X amount less likely if you're using that platform.

That's lovely if the data exists in the public domain.

Correct. And then I'm like, is this UX-driven, right?

Is this cost-driven?

What is the different part?

Or the strength of infrastructure, which is the least likely one, but who knows?

But then, if we follow your assumption, your hypothesis that, oh, no, everything is just User-based, right?

As it should be the same across.

You do not reach the clouds themselves, right? There shouldn't be a difference among the infrastructure choices.

So, that is wrong.

Anton is the previous analyst who coined this line. I'm just a quiet supporter. I'm a supporter. So, yes, I'm wrong today.

Okay. Now, listeners, Anton won.

Alex won.

I think we should stop at a draw.

Yeah, yeah, yeah.

We'll stop at a draw. Actually, we're out of time, so I have to do this. One, do you have a tip to help people improve their cloud security? And 2, other than the DVIR? Okay, the DVIR is the recommended way.

Okay, great. You're dispatched with this one.

One tip, one tip to help people not end up in your report for cloud breaches.

I think you have to be— you really have to try to understand what are the kind of the interfaces that you have, right? Understanding the interfaces, how you control, and how you interact with the cloud services that you're using, right? Because again, it's very easy to think about, oh, I just put it all in the cloud, so I don't have these problems anymore. There are new problems. And if you think there are no new problems, you mean you haven't found them yet, right? You just changed the shape of your risk rhombus, you know? It's a different animal now. You have to figure out where your new kind of risk leverage points are, because there are, they are, they exist, right? It could be something as simple as the credential stuff we were talking about, enabling MFA across the board. Some solutions are very, very simple, right? But you kind of have to understand what the shape of the interaction, right?

Yep.

The shared, the fabled Cloud Security Alliance shared responsibility model, right? Where does your responsibility end? Where does the other one start? If you don't have a good grasp at that, like you're just like rolling the dice every day. Totally. You know, you're gonna open the newspaper. Oh, did I win the vendor lottery today?

Yeah, you may. Yeah, correct. You may.

Yeah.

All right. Well, this was thoroughly depressing, which perhaps is not surprising. Listeners, let us know what you thought. Alex, thank you so much for finally joining us.

Of course, it was a pleasure.

Let's not have it be another 4 years before you come back.

Oh, yeah.

Let's not.

And do read DBIR.

And do read the DBIR as a human.

As a human.

And after you're done—

Stop it.

After you're done with the DBAI, go check out the M Trends.

It's pretty good. That's so nice. Yes, check out M Trends too. Awesome. Alex, thank you so much for joining us today.

Of course. Thanks for having me.

And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us, and if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast.

By Google.