EP248 Cloud IR Tabletop Wins: How to Stop Playing Security Theater and Start Practicing

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior PM for Detection, UEBA, and Risk in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. Follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we have a super fun episode today. We're talking about Dungeons and Dragons, right?

Not exactly. And I think that for some reason, I am more tweaked by the fact that this episode would probably be one of the first video episodes that we are doing as like not live video. So I'm being a lot— I'm self-conscious, I'm glancing at you, I'm checking whether my cringe face is properly cringy and all that stuff.

Sounds about right.

But it's an episode about training.

Training.

At least I think of it as more training in D&D. Training versus training for battle versus battle. I feel like this is why so many people prefer to go into battle without first training.

I think that's the worst way to go into battle.

It's absolutely the worst way to go, and that's what people do in many cases. And also, I think our guest told us there are examples where the generals train, but they do not tell anything to the troops who do not get trained.

That sounds cruel.

Actually worse.

Yes, yes, that sounds awful. So listeners, if you're wondering what we are possibly talking about with these weird tortured analogies, Maybe without any spoiling, let's turn things over to today's guest. Today we're joined by returning guest coming all the way back from our episode about teamwork under adverse conditions. Joined again today by Gibran Ilyas, a director for incident response at Google Cloud Mandiant. Gibran, thank you for joining us today. You and I had one of the, I don't know, scariest conversations of my career ages ago, but we're talking about something a little bit less scary today and also something that I love personally doing. in my spare time, which is tabletop. But we're not talking about D&D, we're talking about tabletops for incident response preparedness. What's the story here?

So tabletops for incident response, I mean, if I could sum it up, it's more like that Sun Tzu quote, the more you sweat in peace, the less you'll have to bleed in war. So it's basically like building the muscle memory for dealing with the incident. So when the 11th hour comes, You're not panicked. And, you know, what happens when you're making decisions in panic? They're not the right calls. You are very irritated at your team. There's a lot of finger-pointing, lots of bad decisions. And then those are the decisions that actually come back to bite when, you know, there's lawsuits, be it class action lawsuits, be it lawsuits from your partners, be it like scrutiny from the government and regulatory bodies. So it's basically like a set of rules that you're agreeing to coming together before the incident. So you're making some really good decisions and penning it down so that when you actually have an incident, you are not fighting amongst yourself. You're basically saying, hey, based on our organization's risk profile and risk appetite, these are the calls that we agreed that we're going to make. So here we go. Now we just have to practice. And then there are, you know, several playbooks for different kinds of scenarios. So once you've gone through those playbooks in tabletop exercises, And you've got that muscle memory built in, it is very smooth.

So, let me ask you an absurd question, which is not on the script. I know it, you know it, maybe even Tim knows it. I don't know about Tim, we'll see. But this is super easy, it's cheap, it's useful, and it does help a lot. Why is it seen as kind of like elite pursuit? Why only the enlightened people do it if it doesn't take a million-dollar product to do it. It doesn't take a lot of advanced skills. You may need a facilitator, but it's like one consultant, probably from India for some time, or maybe even no facilitator. So why is it not all over the place? Why is it seen as an elite practice?

You know, it got introduced by, say, the executives and the external councils. So when they get in the room, they, you know, they deal with just the executives, right? And they just do Very high level, right? And, you know, I like those tabletops. You know, those are equally fun and equally, they help with the preparations. But, you know, in those tabletops, there are a lot of assumptions. Because it's a 2, 2.5-hour tabletop. And I'll tell you, Anton, Tim, it's like they think there's a magic wand for everything.

There is.

Like, oh, okay. Yeah. I need cloud logs. Okay. This will come in like 10 minutes. But when we actually do the same tabletop with the technical team, They go like, oh, first of all, I don't know if we have the logs. Number 2—

That's right.

If we have the logs going as far back as Gibran wants, right? And then third, we don't even know, like, if we have hot storage for this or cold storage. So, we got to go to, like, a vendor or, like, a third-party backup provider to get it. So, yeah, I think it's because it started with more executives and the external councils, it's the default is the first level is, okay, go. run it with the executives because they never see it. The tech people, they're dealing with one incident or the other, so they have more practice. But I will tell you this, now, after having done multiple ones of these, the execs are also saying that, hey, whatever we're saying, is it that simple? So they're the ones saying, hey, look, let's go to the tech because whenever we have an incident, it's never that smooth. But in tabletop, everything is smooth. So—

Really?

That's right.

Yes.

Okay.

You need to actually do one with the tech team, and then When we escalated to you with the information and the timeframes, because the timeframes are really important, the first 72 hours, you know, they set the tone. And if you're basically not making decisions, and if you're like stagnant and, you know, very scared, I mean, that whole culture or that whole lack of momentum, it translates to everybody and your vendors, experts.

Hmm.

But if you become very positive and you go make some really, you know, consensus or a decision and you go for it, Then the momentum turns very positive. The worst thing is, like, in 72 hours, don't wait, wait, and wait, because you are going to have to make the decisions with imperfect facts. Executives are not very comfortable with it because they are the ones who are going to answer at some point, right? So I think that is very—

It's pretty uncomfortable to be in Congress and say, well, Congressman, we thought the adversary wasn't on that server.

Yeah. Yes, that's true. You touched on the right thing because they're— The executives are getting so much pressure from their business partners for recovery.

Hmm.

So there's a big decision to be made, right? Hey, are we going to preserve the evidence for forensics, or we're going to go for recovery because that's what our business partners are asking? And if you're not doing it, I mean, in defense of executives, then they are severing the connections. So all the money streams, all of that is gone. So they have to make a very, you know, precise business decision on what they want to do. And that is a very tricky decision, I would admit. But if you don't have the facts, you're going to play a lot of, you know, at Chuck E. Cheese, you play the whack-a-mole game. So if you don't have the facts, you're basically playing that. You recover one part of the network, the attacker comes back in, and they infect you all over. And that is actually a bigger frustration, right? Because imagine you going in, like, some board meeting and saying, oh yeah, we've recovered this part of our business. And then 2 days later, oh, by the way, that recovery, it didn't go so well because the attacker That actually makes sense.

And I think that maybe the key lesson here before we go to the next question is that if you just do the high-level, quote unquote, executive tabletops, you're kind of missing out on most of the value because actual implementation would be by magic. Oh yeah, and then we remediate. Oh, you mean like 500 systems with 3 people? No. Then we spend a month remediating.

That's true. It's the same people who are doing, you know, the IT work and security work and then, you know, giving us the data to So it gets really tricky on, you know, where are the cycles that need to be spent. I will tell you this, right? One of my favorites is when I go, people are shoulder surfing me. They're like, hey, did you find the attacker yet? Did you find the attacker yet? There you go. I'm like, hey, man, the TV has kind of spoiled you. This is still day 1 or day 2, and I still don't have access. That's the other thing, right? A lot of people don't think that access is going to be a problem, but third parties needing, like, God kind of access in the network. It's not easy. They would give you like a VDI, but VDI doesn't give us anything. You know, the, if we can't pull the data fast, if we don't have direct access to the SIEM, to the EDR, we can't do our job. You know, we need access to their data lakes. We need access to the raw data. And they go, yeah, this one is gonna take 48 hours. And we're like, this, these are the 48 hours nobody has, you know?

Yeah.

So I think when we're doing these tabletop exercises, we basically ask, hey, like, if it is hour zero, how quickly can you give Mandiant access to your attack EDR or SIEM or cloud? And they go, yeah, that's going to be a problem. We're probably going to have to provision our own corporate laptop for you. We're going to leave like 5 aside in our data center, and then we'll just ship you that. Or when you come on-site, we'll give you that. That works very well. So if there's one key lesson for anybody who's listening and thinking about preparations, Think about that. Are you going to be able to give all the kind of access via VDIs and like these remote access technology? Probably not. So just set up 5, 6 laptops and then disable those accounts. But then all you have to do is enable the accounts. Your permissions are configured right there, and it's tested beforehand that, hey, look, these permissions work for EDR, SIEM, and all the other clouds that we have that we need access. People have, you know, 3 clouds now. You know, people are doing AWS. Sure, sure.

Which reminds me, like, as far as this being a cloud security podcast, do you have a favorite scenario for tabletop that involves cloud security? I've heard people say ransomware, but I'm a little surprised about it because, like, there's not that much ransomware in the cloud. So, what is your favorite cloud tabletop?

Before you answer that, I do want to touch on something you said, which is that expectation management with stakeholders looking over your shoulder.

Yeah.

I have a buddy who's a homicide detective. And he tells me how juries expect all this DNA evidence from TV shows that, you know, usually isn't there. I think that's a really important point for executives who are thinking about a tabletop or participating in one to internalize is there's gonna be expectations that just aren't realistic.

Yeah, yeah, that's very true. Can't agree more. It does take time sometimes. I mean, you know, think about everybody in the first 2, 3 days of the incident, right? They come with that mindset that, hey, I'm gonna be the hero. I'm gonna stay up 16 hours and, you know, work all the shifts. and I'm going to bring it home.

Yeah.

But it's really a marathon. It's not a sprint. So, you know, they do 3, 4 days like that, and then the 4th day, their decision-making is very bad. Then they're pointing fingers. They're not being nice to their folks. So, you know, there's a lot of— we don't talk about the human element of these incidents. There's a lot of human considerations that you have to give. Like, if folks who are managing the incident, like all of them, not just tech, but execs and third parties, if you're not giving them the chance to charge their batteries, right, by going to their gym, you know, going to see their kids and spending time with their wives and, you know, whatever charges their battery, if you're not giving them that chance, they're not themselves and they're not actually contributing. They're just, you know, putting in hours. But I think the fun is when everybody Owns the problem, right? They own the issue. And then, like I always say, magic happens when everybody has the right ownership of it because it is so tricky. I mean, there's no tabletop that can prepare you for the actual thing. There's just so many variables. But if everybody comes together and they're happy and they are getting their rest, they're getting their nutrition, they're, you know, getting enough sleep when they come, their 8 hours are all magic. You want that. Right. And, you know, people laugh when I say nutrition and, you know, you need to have like food and ice cream and whatnot. But I will tell you this, you probably can relate to that. If I told you, Anton and Tim, I have an onsite next week, they have really good ice cream and they have catered food.

I would totally come for the ice cream. Yeah.

So I have better luck convincing people to come onsite with me when those things are there.

But that means that these tabletops aren't just like a short endeavor. This is kind of like, these are multi, occasionally what, multi-day?

You know, now with the tech teams involved, day 1 is tech, and then day 2 is exec.

Ah.

So this is the pattern that I'm seeing, that you go, you start with the tech team because, you know, at the beginning you don't know if it's a real incident or not, right? It gradually becomes the crisis that we see in the incident. So before, it's like some SOC alert and some, you know, as we go investigate, we learn more about where the threat actor has been, and then it becomes an incident that requires, you know, part of their incident response response plan or playbook. It requires who to contact. So, you know, CISO gets involved, then, you know, CIO gets involved, then legal gets involved, and then they bring in board of directors. So that gradual notifications, you know, that is a good way to go about it because, you know, what are people going to know about, like, a SOC alert, like, from exec level, right? They want to know, like, hey, is there real damage? Because there's so many alerts. You know, we live in this SOC world, so there are so many alerts. You're not going to— You don't want them in every single event or incident. You want them in the crisis mode.

So yeah. Okay. So all that wonderful insight about recharging people's batteries and bribing people to offsites with ice cream, we do have to answer Anton's question because we are still the Cloud Security Podcast by Google. What are some good cloud tabletop scenarios?

Yeah, cloud is one of the most fun subjects for me, right? Because, you know, a lot of people say, yeah, we have this cloud environment on the side and I think the majority of them are hybrid. That is an understanding that's lacking in a lot of technical people's minds. They say, yeah, we got this, you know, the SaaS service that we're doing in cloud. So, you know, when we do these cloud scenarios, I'll tell you, you know, the compromise assessments that we do and threat hunting that we do, very often, like, they convert into an IR. But, you know, this one—

Of course they do.

Cloud tabletop actually turned into an incident. It was one of those where, you know, the scenario was that an attacker finds like a personal access token on GitHub, right? And then they start using TruffleHog to get more, you know, secrets.

Hey, TruffleHog, that comes from Dylan Arey, friend of the show.

Dylan, yeah.

We've had that guy on the show. That's great.

Yeah, that's awesome. It's a great tool. I mean, we see this all the time by good folks and And the bad guys, so it's a favorite of both. So while we're talking, right, like, personal access token, so the execs kind of went, so you have to have some credentials before you get to PAT, right? I'm like, no, that's on your publicly GitHub, right? And they go, oh, wait a minute.

Wait a minute.

Let me just, you know, text somebody if this could be a thing in our environment. While we're at the tabletop, they're like, hey, I think I'm going to go out and come back. He takes a call. He's like, shut down everything. We're going to go into incident mode. So, this practice thing that you're talking about, Gibran, this is going to turn very real. And that's what happened. So, very, very interesting stories. I think what people don't understand is that there's just so much exposed sometimes in your cloud environments that you don't know because you're not scanning. from inside for those secrets, but that can give a lot of access. Like, once you run Trufflehog after that, you could put a lot of things at risk. So, one other one I would say, in a scenario where attackers are on-prem, right, and then they get the NTDS.DIT file, like the Active Directory database that has the password hashes, so they compromise the cloud administrator's password, if they decrypt that, then, you know, the attackers move into the cloud. They move into their Entra ID, and then from Entra ID to some cloud console. In those scenarios, it's interesting when we're sitting in tabletop. So these folks go, oh, I know up until the on-prem, that is my area. But this Entra ID and, you know, all of those Intune things that you're talking about, I don't even have the right people in the room because I thought this is— Separate, you know? So I think there's some lack of, um, education for a lot of the people who have been doing on-prem. They've hired people to do cloud, but, you know, they're not necessarily talking to each other at all times. Right. So it's, it's kind of shocking to them that, oh, this could happen. Somebody could come in on-prem and then move to the cloud. But, uh, majority of the setups, even though people claim that, hey, their cloud is separate and their on-prem is separate.

You know, this is stuck in my head. for 2 years after I attended a session by 2 Mandiant consultants that was beautifully done.

I knew you were going to bring that up.

I knew it. Yeah, yeah. I'm just like, I'm sorry, but it's like, it's not a jab against anybody, but it's just like, it's such a pithy line that whatever you do in the cloud, you're still owned through AD.

That's right.

But it's depressing because the presentation was what, 2023? It's like 2 years this, and you essentially tell us the same exact stories that if you have this beautiful cloud built on some third-party cloud provider or whatever, and then you get owned through AD.

Yeah. I mean, think about this. It's not just cloud that has that AD connection. It is your virtualization platforms, too, that you connect with AD. That is for, by design, to make it easy for admins to have just one set of credentials doing everything. So now what we're seeing is, let's say, like, you know, attackers get into the vCenter and the ESXi boxes, and they're not even going to the operating system layer to encrypt the boxes.

Right.

They're just mounting the VMFS share on the NAS and they're just encrypting the boxes, like the VMDK files. So you can't even boot from those systems. And, you know—

Ouch.

Yeah, the ouch is not just for them. It's for us too. So imagine our lives, Tim and Anton. If we can't analyze those boxes, right, we're coming up empty, right?

Yeah.

And when they're restoring their, you know, VMDKs, that's from like a prior time when the attack wasn't happening. We're coming up empty, and we're doing, like, deep, you know, the analysis that we used to do 15, 20 years ago, like, take a forensic image, transfer it to the lab, lab processes the chain of custody, and then we get access. That's like a 48-hour delay right there, right? And we're not getting good data because, you know, the VMs themselves are encrypted. So then the decision-making for the decryption key, for paying the ransom, is not just that, hey, we want our data back. It is like, hey, the broad needs to do its job to give us the answers. So that whole single sign-on and all that you're talking about, that hits home for so many different things in the network. And ESXi compromises, I mean, the recovery path is so long because you need then clean virtualization platform. Then you need to build domain controllers on top of it, your old identity management, and then basically the thing. And that's one of the realizations that we've been trying to preach in these tabletops, that a lot of people say, hey, look, we're breached, we know. Like, you know, for airline would say, hey, we just need these applications to keep our planes up in the air. But it's not that simple. You have so much dependency before these, you know, 30 servers or 30 applications can go online, right?

Right.

You need to build your identity. You need to build your VPN. And so all of that That muscle memory of like, hey, recovery is going to be a long process, and we need this many parties. There are so many stakeholders these days. People used to think that we just go in as investigators and we do everything. So now, just think of— just count the number of people that are involved in an incident response, right? So you have your incident response, you know, the investigators, right? That is a sure-shot thing. Then, you have containment remediation people. Then, you have your threat intelligence people, right? Because they're guiding you, hey, here are some more IOCs. Go run this, or, go to this server. They always go to SQL, so go there. Then, you have your crisis communications people, right? That, I mean, is such a key because you could have a really good technical response, but if you have really poor communications, it's a failure, right? And these communications are not just to the public. The communications go to internal stakeholders, your business partners, right? Social media, media, you know, and then to the government, as well. So if you don't have the right communication folks, it's not a good incident response. Then, you have people who have to review the data, like for extortion scenarios.

Hmm.

You can't just trust the attackers, right, that they have your data. So first, you need to receive the data, like proof-of-life data, and then you run it with your business folks, that is a whole thread that, hey, is it our data, number one? And is this our data that actually matters or no? Because, you know, we're going to have to make a decision of, like, $10 million-plus ransom payments. So you have to do that. So, and then, you know, there's one thing that is really, really key in these investigations. It's called attestation by third parties. So a lot of people, like, want— you know, they hire Mandiant because Mandiant's logo on the attestation letters, that means a lot. Like, if Mandiant says the compromise is contained, Then, you know, the business partners will connect back to their network. Without it, unfortunately, the victim's word is not trusted that much, right?

Mm-hmm.

So they want, like, Mandiant to say, hey, look, we found the root cause of the incident. We have contained it. And this particular environment is now green, like it's ready for production. So now we'll connect back. So there's a lot of things going on. There's a red network, a yellow network, a green network. So all those things, I mean, that requires manpower. And if you don't have it, it's a real challenge. Like one of the things that I am a big proponent of, I like very empowered project managers in the war room.

Mm-hmm.

Because if they're not there, then the delays in tasks is really long because if, you know, everything is connected. So for my task, there could be a prerequisite that somebody else needed to do and they don't do it, then I'm delayed by 24 hours.

Sure.

So, and then the other thing that's very important when I say empowered project managers, like, let's say we go through 2 weeks of containment remediation, and then the 3rd week I'm up at 1 and I see the threat actor.

Oh.

And I want to shut down a server. So if I don't get the person online to make that decision, can I, you know, bring the server in quarantine mode? It's disaster, right? Because 2 weeks, so many people, like 50 people working on an incident, working so hard. But then, because I can't get a response from an empowered person, I let it go for an hour, and then attackers are creating beachheads again, and then we have to do it all over again.

And then we essentially redo the 2-week project at the same, at the cost, right? At the same, well, you're not gonna get like a 2-for-1.

Yep. Yep. Yep. So a lot of like good decision-making and a lot of empowered people. So when we do these tabletops, we ask, hey, do you have somebody who's gonna take this project manager role? So the more mature companies, they're now like putting in their best project managers on this.

Really?

Yeah. Like the best or head of project management. Like, hey, you're gonna supervise this because people know you, people are gonna respect you. And when you ask us, even the execs and the ELT, EMT, we're gonna respond to you as if, if we just put some second year, third year project manager, they're not gonna respond.

Mm-hmm.

So like we have these spreadsheets that we are tracking that, hey, you must have this done by 7:00 AM or 7:00 PM so that, you know, minion can do, you know, what they want to do. Because if you don't, then we're delayed by, you know, 24 hours or like 12 hours. And that sort of frustration nobody wants.

Right.

You always want like a very positive, very healthy environment because, you know, everybody's doing their best. So, I think the awareness and those reminders, because, you know, think about this, Anton and Tim. You have like 12 things. You could probably remember 6 or 8, but there are 4 that are probably going to slip. So the project managers, they're like, hey, Jaman, you know that, right? You gotta do this. So that really helps.

So this has been such an amazing, like, deep dive on tabletops and psychology during these events and what actually goes into incident response. Yeah, I hate to do it, and I can't believe it's already time to do this. I have to ask our traditional closing questions. One, do you have one tip to help people get better at tabletopping or even get started with it? And then 2, do you have recommended reading for people? And that could be anything from like the D&D Dungeon Master's Guide to, you know, just not Anton's blog.

Yeah, yeah, I would, I'd say this, like a lot of people just say, hey, Gibran, go create a tabletop. I don't think that's the right approach. I think it's, if you want a tabletop, you want to work with me to number one, understand who your adversaries are, right? So I can make a very custom Tabletop. And then not just that, I want to work with your tech people to create a scenario where, like, if we're mentioning, you know, your Oracle servers, I want to make sure you have Oracle, you know, otherwise it doesn't hit home. So the more you customize the scenario, like, I'll give you an example, like, if there's a threat from PLA, you know, China, right?

Yeah.

You say, look, this is their 5-year plan, they're gonna go after energy, you are an energy company, so So, you know, that brings it home. That's the first part, who the threat actor is, what they're going after, right? But then also, like, hey, you have this virtualization environment on, like, vCenter ESXi. So the scenario will have the server names, the IP addresses, and everything. So the tech, when they actually see it, their eyes pop up. Then, you know—

So in that sense, every scenario is custom, right? Every scenario is then custom. Essentially.

Yeah. Not every scenario is custom.

They just print from the internet.

Yeah. So I think it's custom enough that it, it mentions like what they have, but not custom enough to a point where they're, we're mentioning their hostnames, their IP addresses, which data center it's at.

Mm-hmm.

Because there's so much logistics in these incidents that you need to understand that. So the more custom it is, the better attention you get from both the techs and executives.

Mm-hmm.

And then I think have legal in there. Because, you know, if you leave it for people like me, I, we love to watch the attackers, right? But at one point, the lawyer's gonna say, hey, look, this is consumer data that's leaving the building. Zibran, I know you wanna watch the attackers because you wanna defend them well, but we just can't allow it because regulators are gonna kill us.

Mm-hmm.

Right? Like, if we let this go and we can't defend it, like, you know, 6 months down the road. So like customization, legal in there. I also am a big proponent of like law enforcement, cuz people have this negative reaction when we say it, but they've changed a lot. FBI is now able to get decryption keys for some of the threat actors for ransomware.

No way.

Yeah. And they're also— they have those relationships with the cloud providers. If your data is in one cloud, they could seize it quickly. Sometimes they could actually, depending on which US Attorney's Office that they deal with, they could get us the forensic image of the attacker server, which I will tell you, my folks love to investigate. This is like a reward that I give them, that, hey, you get to investigate an attacker server. And they go like, man, you're the best boss in the world. So that's that. And then the thing that you asked about reading—

Yeah.

Again, the quote that I started with from The Art of War, you know, you want to have practice. And the more you practice these scenarios and with the right stakeholders, the better. Because you don't want— think about this, right? In an incident, right? Like, let's say me, you, us 3 are going to go into crisis mode. Isn't it better for us to have met before than meeting the first time? Yes, because in an incident, as much as you need an expert, you need a friend, right? So when you go in, just like, you know, when you're going on a stage or doing the— for the first time, you have these butterflies in your stomach, right? But if you have already worked with those people, the trust is just amazing, right? The day that I show up without meeting people, people are like Very, you know, they don't want to open up to me because they think I'm going to put them under the bus. I'm going to take— be the cause of their job, right? Like if they lose the job. But if we've met those people beforehand in these tabletops and prep sessions, they're like, Bron's my friend. I'm so glad he's available and he's here. So he will take care of it. And they know all my background, right? Like that, hey, I led this breach, that breach. It was like, hey, if he could do a breach for like 3 billion accounts, we've only lost 100,000. So there's like— This relativity there. And they go, you know, I kid you not, I feel like I don't do anything technical. I'm like a therapist now in this current role. So, but that sort of comfort, you need to get the human aspects right first.

Mm-hmm.

And then you go into the tech. If you don't have that right, there's a lot of chaos and nobody likes to work in chaos. Right. And then later on, people just leave. So imagine you having people for 15 years, and because you didn't treat them right, they will remember that, you know, when they have a next, you know, opportunity on LinkedIn or somebody needs them.

Sure.

They'd be like, you know what? This guy was not nice to me in the breach. He didn't care about my child's soccer game. He didn't care about my wife's birthday. So now that I have an opportunity, I'm going to go. And that's a bigger cost, right?

Incident is going to come and go, but the lingering cost is something that you Well, Gibran, I can't thank you enough for your time and expertise and such thoughtful answers. It's a pleasure to have you back on the show. And listeners, thanks for joining us today.

Thank you so much. Happy to be here.

And now we are out of time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us, and if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast. By Google.

Security.