EP266 Resetting the SOC for Code War: Allie Mellen on Detecting State Actors vs. Doing the Basics

Security. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts, as ever, are myself, Tim Peacock, PM for detection and all kinds of stuff in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. youtube.com/@cloudsecpodcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on our LinkedIn, our Twitter, and our Google Cloud Security Community page. Anton, we are doing another one of our— this must be our 3rd or 4th now, like society and cyber episodes.

Right. But also war. Don't forget the war.

Oh, sorry. The opposite of society. War.

Yes. Society and then global issues, but also definitely war.

Yes.

Yes, war would make an appearance and cyber war.

A former guest makes an appearance.

Yes, that's correct. And then I think it's kind of the insightful, somewhat lighthearted, but also kind of heavy episode. And to me, this is kind of what makes it fun. But even though this time I give a brief pause before I say fun.

It also, even though it has that pause fun nature, it also has surprisingly, I thought, practical advice for security leaders dealing with the realities of the, well, dare I say, realist worldview that Allie presents.

Correct. Correct. You just spoilered the guest, so it's time to hand off the show to, well, to the guest.

Let's do it. Today we are joined by none other than Allie Mellon, principal analyst at Forrester and the author of the upcoming book Code War: How Nations Hack, Spy, and Shape the Digital Battlefield. Allie, thank you so much for joining us. We have been talking about having you on the show for ages, so I'm delighted to finally have it happen. Your book is all about the US, China, and Russia. When you were planning the book, how did you pick those 3 and not other cyber notables like, say, Israel, Iran, North Korea? What was the origin story here?

Yeah, absolutely. Well, thank you so much for having me. I'm thrilled to be here. You both are such fun people, so I know this is going to be a great conversation. It's a really great question because To be honest, when I was first putting it together, I was so convinced that I was going to do a lot more than just China, Russia, and the US. I was like, I want to do North Korea, I want to do Iran, I want to do all of these. But it turns out books have to be a certain length.

Oh no.

And you can't go over that certain length, or it's not a good idea to go over that certain length. So even for China, Russia, and the US, which I ultimately decided on because First off, I wanted to hit the top cyber powers. I feel like they have the most history to pull from, the most information to pull from that we can understand. And so China and Russia were automatically on that list. And then from the other perspective, it was really important to me to include the United States because I do see the United States as, of course, a cyber power, but also as its own threat actor. And I don't think that we talk about it in that context enough. And that goes from the standpoint of, yes, for actors or towards other nation states, but also towards the citizens of their own countries as well, which is an element of this that I get into. So it was important to me from that standpoint, and I talk about this in the book, like the difficulties with attribution, how so much of that is tied up in the fact that we just don't have a lot of threat researchers that we can necessarily trust the output from, from countries that aren't in the Western world.

Hmm.

But based on the information that we do have, these are the things that we can talk about, which is what I go into. I would absolutely love to dig into some of these other countries, and I am disappointed that I couldn't do it. But to be honest, even with what I wrote about the US, China, and Russia, I ended up having, I think it was around 136,000 words in the book. And I sent it off to Wiley, the publisher, and they were like, okay, we have to cut out 40,000 of these. So good luck.

I'm shuddering already.

Yeah.

I'm trying to imagine Anton deleting even one word from one of his blog posts. Let alone 40,000 of them.

Yeah.

I'm just not going to comment on this. It's just too painful and too emotional. But yes, we have a list of questions, but I want to kind of detour a little bit to the side and say—

Oh, good. A detour already.

And ask something about the book. I mean, I kind of have 2 strange questions related to the book. Like, there was somebody who suggested that the space of cyber is too dynamic for a book, any book, yours or somebody else's. to sort of be able to handle the dynamic nature of it. I argued with that person by saying that there are some fundamentals that should be in the book so people can refer to them. So is that the motivation? Like that it's something like more of an evergreen resource as opposed to like collection of news stories?

This is such a great question. And I completely understand that person's point of view because even as I was going through it, like this was a 2-year process, right? This was not a short process. And Throughout those 2 years, I kept running into things that would happen, like in 2025 especially, where I was like, well, I have to include this in the book. I can't not include this. But at the same time, I don't have the room to include this. And so, it's very difficult with such an evolving field where the attackers are changing, the ways they approach things are changing, to make it all tangible and tied together. But what I will say is, a lot of what the book is about is, we're not doing a bunch of in-depth technical details into the That's not the goal of this book. This book is about how do we look at the history of these countries back to like we're talking BCE China. How do we look at the modern day of these countries and how both of those come together for these countries to make the decisions that they have from a defensive perspective and from an offensive perspective? And that was the original hypothesis when I went into this is that there is a lot tied up in this, in part because I'm just a big fan of like the history of war. And that hypothesis was proven out every time. And that's what I really love about it is, I don't know if there's a single section of this book that doesn't start with a historical story that has nothing, or seemingly has nothing to do with cybersecurity, that ultimately ties back significantly to the cyber activity that they're perpetrating, whether that's on the defensive or offensive side. So, I would push back and say, I'd love for that person to read this book and then tell me what they think, because— Certainly at the strategic level and where we need the rest of the population of the world, not just like us as cyber professionals to think about it, there is so much that is consistent and that we can learn from. And then at the end of the book, of course, I take a look at like the changes that are going to come and are coming with generative AI as an example to talk about, yes, there are certain things that are going to fundamentally change here and here's how that works.

Not to be mean or Not very nice, but it doesn't sound like that person who said that reads a lot of books to begin with. So I'd be surprised if they read yours.

Correct. That's very fair. But I think that it's the ever-changing world point of view. I mean, there's this ever-changing world point of view.

No way. Because, like, sure, TTPs change, but the history of why a country does what it does, that doesn't change. It's history. It's already passed.

I agree with that. But it's like I have to defend the book approach over it should all be tweets or it should all be—

I love that we're living in a world where we have to defend the concept of Well, I do think it's interesting because like it does come back to like one of the things that I'm seeing a lot, especially with the way that people are thinking about like Russia, the United States, and China, but mostly Russia and the US is like, we didn't think that they would do that.

Hmm.

And that's mostly because they don't understand the history of these nations. And once you start to understand it, you're like, oh yeah, of course that's what that nation is gonna do. Of course that's the direction that we're moving, even though we think that we've made this type of progress or we think think that we would never do something like that. The reality is we've been doing that forever. So I do think there's an element of this too, where it's like, I'm sure that if you don't understand the fundamental history of why these countries are the way that they are, it seems like everything that they're doing is a surprise. But you talk to a historian and they're like, I told you 20 years ago this was going to happen.

So no amount of following the tweets from today would inform you. It would have to be the background and the story. We all agree But it's just interesting how this— we seem to be kind of an island in some sense. Okay, let's go back to cloud and threat actors and, you know, other fun things.

On the Cloud Security Podcast? Yes, let's do it.

Yeah, no, but I mean, I just loved that sort of like quote unquote defense of the book approach, defense of the fundamentals, because ultimately that works and it's true and it just needs to be spread or be kind of defended in larger population. Okay, so back to the cloud. Yes, we talk about nation states attacking infrastructure and kind of like, as you pointed out, digital battlefield strategies, and there's cloud kind of in the middle middle of it. And no, my t-shirt is not here with cloud in the middle of it. It is intentional. It's kind of a coincidence. But the point is that we approach shared responsibility model as kind of one of the fundamentals for cloud security. And I'm nervous when the really top-tier threat actors go after you and your cloud environment, that shared responsibility model holds up in court or holds up in reality, nothing to do with courts. And when this discussion comes up, I always remember the words of Richard Bejtlich from 2009 when he had this vision of, think about cyber analogy would be every company having air defense on the roof. Because what if the bad guy flies with a bomber and you need to defend? Like, that was his vision that it's just, we're doing cyber wrong because if you're against the governments, why is companies defending on their own? It would be equivalent to that. So, this air defense on the roof is kind of my odd visual for that. But so, shared responsibility model, do you think this Is workable if who is out to get you is the best of the best China and Russia has.

So there's so much packed into that. That's really interesting. Like it reminded me of—

Yes. I apologize for dumping it all on you.

It was a long question.

Well, it reminded me of this one quote from early on, which I really loved in the Department of Homeland Security when it was first created in those initial years. One of like the quotes that I include in the book, cuz I try to include like an interesting quote in the book. to start most of the chapters because there's so many cool quotes from people throughout history that relate to cybersecurity. One of the quotes was, I can't remember exactly which DHS director it was, but they basically said that they think that cyber is a fundamentally civilian space. And that to me was so interesting because it really encapsulates a lot of the US's approach to cybersecurity, which admittedly has changed quite a bit. in the past 2 decades, but that is fundamentally where it started, is this belief that it is a civilian space and not something within the control of the government. Now, when it comes to the cloud providers themselves, and especially some of the largest companies in the world, tech companies in the world, I describe these in the book at the very end of the book as the 4th power. And I really like this framing of it because Tech companies come up throughout the entire book. There is not a section of the book that doesn't talk about a tech company. They are everywhere, right? I mean, if you think about it, Instagram has like on the low estimates, 2.3 billion monthly active users. That's more like than any population of any country in the world. Privately owned undersea telecommunications cables carry around 99% of international digital communications. Google, Microsoft, Facebook, and Amazon own or lease half of it. Like the tech companies own so much of the internet infrastructure that we use and have so much of the attention of the citizens of these countries. They have more economic power than many countries in the world. They have more subscriber bases than many countries in the world. It's impressive, but they aren't actually stronger than the actual states that they're operating under. And that's the thing that they consistently get wrong. That I find so interesting is there have been many instances throughout history, especially in the early 2000s and especially in China, but also in Russia, where very large tech companies, including cloud providers, have gone in and said, we're going to make this country better. We're going to make this country become a democracy. And inevitably, every single time they fail and every single time they cave to the censorship and the authoritarian requirements of that nation. In order to stay in that market. And sometimes they push back, don't get me wrong, but there's a quote by Max Weber about this that I really love. He was a German sociologist in the late 1800s.

Oh yeah, we know who Max Weber is.

All right, here we go.

Here we go.

Yeah, come on, come on, lady.

What are you doing to us?

What did he say this time?

A government is an institution that holds a monopoly on the legitimate use of violence. I love this quote because even though the tech companies have a legitimate hold on our attention, they do not supersede the government's control and monopoly on violence. And so in instances where tech companies try to operate in certain countries and the countries want them to do certain things, they end up doing it because the country's just like, okay, then we're going to prosecute, quote unquote, your employees in this country. And we require you to have employees in this country to operate here. So we're always going to have employees that we can prosecute if we need to. So there's always an element of control that even though, like, coming back to this, the main question, even though the cloud providers are so large and in many cases are one of the first frontiers from a defensive standpoint, they are still beholden to the nations in which they operate. And so I go back and forth on this a lot because we've seen a lot of instances where ultimately these companies will cave. And they will cave to the requirements of the nation that they're operating under. But coming back to your point, which I do think is very important here, depending on the size company we're talking about, they need to be having their cloud providers, having their service providers manage a lot of the threats that are coming from nation states because they don't have the time, resources, and in some cases, they don't care enough to do it themselves. So, I think the shared responsibility model, to a certain extent, does hold up and is something that is a requirement to reduce risk for certain businesses, but it's not perfect, as with anything.

So, I hear, as Tim knows, I keep making lawyer cat meowing jokes, and I hear lawyer cat meowing in my ventilation. And the reason why they're meowing is because Elie's point kind of kills the digital sovereignty logic. Because if you are a provider from country X and you show up in country Y, country X still has power over you, and so does country Y. You can't not have one of them have power over you if you operate there, right? That's ultimately the summary of what you said.

Yes.

And this has been the tension of global platforms since like France banned eBay from selling Nazi paraphernalia in the '90s. Like, this has always existed. I love that Max Weber quote, by the way. That's great. And it's so true.

It's so good.

It's so true.

Let's go to safer subjects, Tim.

Yeah, let's go to safer subjects. So I wanna bring together your day job with your book job and ask a question about the SOC reset you've been talking about. How should a company shift their distraction strategy when it's not scattered spider looking for ransom, but Fancy Bear whose goals are multifarious, long-term, and very different than, hey, I've got your stuff, give me the ransom? How, A, does that change things? And B, for most companies, how should they think about that trade-off of defending against the ransom versus the— Long-term, very clever adversary.

Yeah. So to me, this is all about the strategic risk conversations that you're having and how you're having them. Like, one of the points that I really wanted to drive home in this book, and one of the reasons why I intentionally made it so that anyone could read it, was at like any technical level, whatever. If you're interested in geopolitics, if you are operating a business, like you can, you can read this book and get value out of it, is because these conversations, in order to properly address the challenges from a geopolitical standpoint, are strategic risk conversations. If you're thinking about this, if you're thinking about the attackers that are coming in, if you're talking about a teenager that's looking to make a quick buck, they're looking to do something, maybe they choose to prioritize attacking vendors that they're hearing most about, right? We start to see more attacks on AI companies when AI is really popular. We start to see more attacks on healthcare companies when there's a big healthcare event like COVID. That's typical and to be expected. But if you're talking about a nation state, then you need to be consistently evaluating a couple of different things. Of course, your industry. of course, the country that you operate in, but more and more the geopolitical landscape based on your industry and how that's going to affect things. Maybe Iran wouldn't usually care about your business, right? Maybe you're a business that Iran unlikely to care about it. Do they now? They very well could now, way more now than they could have last week, right? That is the unfortunate reality. And one of the things that I really am proud of with this book is the timing of it, because the timing is very important. There is a factor here of like, why now? Why not last year? Why not the year before? Why not 10 years ago? These are historical concepts that are being tied in, right? It's not something that couldn't have been written 2 decades ago or 10 years ago. It would have been different, but it could have been. That is— The thing for me is that we are in such a state of flux because of AI. Because of the geopolitical angles and the fact that that can change in a moment's notice right now, that, that's why it's so important right now and to understand it right now is because we've reached this inflection point of cybersecurity mattering so much more in these geopolitical conversations than it ever has and the chaos of the geopolitical situation as it is. That's also one of the reasons why in the book, the way that I approach it is I start with the Gulf War. Where like, of course we didn't really have a ton of active cyber attacks happening, right? We, this was before the time where you would see the militaries operating in that kind of way, certainly in a battlefield scenario. But what we did have during the Gulf War that was really powerful is this inflection point where people started to realize, especially countries like China, because they were seeing this from the US, the power of joint warfare and multi-domain warfare being used in a cohesive way. That is what kicked off China being like, okay, we got to make changes so that we can use multiple different types of warfare together instead of just one type of like, we're going to deploy troops on the ground, right? For Russia, it was a total validation of a strategy they'd been working with for years since maybe even before the Yom Kippur War, but at least the Yom Kippur War, where they were like, okay, we know radio electronic combat is really powerful, especially when used in conjunction with a bunch of different types of combat. And then for the US, it was validation of a change that they'd been making since the Vietnam War. And so I start the book with that, and then I end the book with Russia and Ukraine, because that's the war that has truly shown us the power of joint military operations when used with cyberattacks. And so it's really interesting to kind of juxtapose those 2 and talk about the power of that. And now I've completely lost track of the question, so I hope that that answered it. I get too excited talking about this.

I think that's a great answer. It reminds me of a conversation we were having with Sandra Joyce. Was that a year ago or 2 years ago now, Anton, where we were talking about disruption of attacks and cyber and physical nexus?

Yeah, that was one of those mildly scary episodes. But, Ellie, you spoke to Sandra as well, right? For the book.

Yes. Sandra is the best. She's so smart. She's so insightful. And she manages to be both in the weeds and also at this very strategic level. love talking to Sandra any opportunity I can get.

Yes, we feel the same way. Okay, Anton, you've got a fun question to come next, right?

I had a long-winded, elaborate way to ask this question, but ultimately what it boils down to is this: how afraid are you of a bad guy with AI? Like, this has been coming up in some episodes. We had Heather, we had Bruce Schneier on the show, and the range goes from If your company is constantly breached by the regular bad guy, then the bad guy with AI is no worse. And that means it's not an extra concern. They're already screwed. So why be more afraid? Down to the other opposite end is, oh no, it's apocalyptic automated hacking. Type what company you want to hack and here's your shell. Like, where do you live in that spectrum? range from kind of normal day in the security land to, are we all gonna die? Bad guy with AI. And whether your book sheds any light on this.

This is something that I talk about a lot in the book, and mostly towards the end. I tried to like, I need to limit the AI insane as much as I can here. But what really struck me was definitely Anthropic's report, research that goes into how China's state-sponsored actor was using AI specifically to orchestrate multiple different elements of the attack as much possible. Have they reached full automation? No. Have they reached enough that we should be concerned? Absolutely. And so that's how I think about this largely, is like, the reality is we are going to see state-sponsored actors this year that have attacks that are fully automated and that can be more dynamic in the way that they operate from the standpoint of what exploits they're creating, what vulnerabilities they're exploiting, what operating systems they're able to create exploits for. I don't necessarily think that these are all going to be novel exploits. Like, I don't— I'm not worried about a world where AI is creating zero days, if I'm being honest, because the way that AI works fundamentally is it's looking at what it knows and what is most likely to come next in the data that it has, which means it's operating on data that already exists, right? Maybe I'm wrong and there's a world where it's just going to be creating zero days like none other, but for right now, I don't think that We're at that point. What I'm more worried about is that we are going to have attacks that are more dynamic and that take advantage of existing issues, existing vulnerabilities, existing exploits that attackers individually couldn't really get to in the same way that they can now. Because, like, before, if you think about the attacker constraints, like, right, like, back when I was hacking, one of the most annoying constraints is, like, you got to decide what operating system you're going to be developing malware for. And you gotta focus on that. You gotta do the reconnaissance to determine if that company even uses that operating system. You gotta build exploits for that. You gotta identify vulnerabilities for that. It's a whole thing, right? Now, with AI, you don't have to worry about those types of constraints anymore at all, because you can say, hey, do the reconnaissance, identify what operating system is being used, then build malware for it. Sure, this vulnerability's been around for 10 years, but those type of exploits are happening every day. They've just been, very specific to whatever malware had been already built and the attacker was already using. Now, it's much more dynamic in how effectively they can iterate and create different kinds. So, I'm very concerned about it from that standpoint. I think that, as with anything, it opens up different opportunities for the defensive side really well as well, right? Like, one of the things that I have a lot of conversations about with one of my coworkers, Sandy Carielli, who covers application security for us and is very, very smart and talented, Is like, how does this change bot management? Is bot management becoming more of a thing that we need to worry about? Because the behavior of these agents is going to most likely resemble bots more than we might have thought it would before. Things like that, where there's more opportunities for defense that we need to be thinking about creatively to address this appropriately. Does that make sense?

It does. It does. Not to be a sad bearer of sad news, but half of the zero days that Project Zero found were in code paths that had just been patched for another zero-day. So the idea that bots or LLMs are not going to be effective at finding new zero-days because their old zero-days aren't in the training data, that hypothesis might not carry out so well.

I see what you're saying.

Yeah, yeah, yeah. I do love the mention of bot management though. Listeners, the shiny things on my wall are patent plaques from my Shape Security days back when Anton won our Bravest Analyst Award. So speaking of Analyst Awards, I want to ask kind of an analysty question. You spent a lot of time looking at how enterprises buy and run security tech. And so for a CISO at like a mid-tier logistics company, you know, like something really not in the critical path, how should nation-state cyberattacks even be in their threat model? Is that like security theater for them to be worried about the SVR when they haven't solved credential theft, or is that still valid for them?

And by the way, sorry for intruding. Sorry for intruding. Yeah, well, of course I would use the term. It sort of brings back the question about air defense on the roof. The mid-sized company is clearly not going to invest in this because they can't. But should they worry somehow? And what are the choices? Maybe that's a sub-question to your question.

And Anton, did I get it right? Is it SBR or FSB? I can't keep saying it.

Yeah, you're probably quoting Eli's book.

I probably am.

You know, these things change every day. So there's a couple of angles here, right? I think that people that operate smaller businesses thinking this is not an issue is a big mistake. First off, I mean, it's—

That's the opposite of what we assumed you would say.

We love being surprised. Go on.

I thought you'd say exactly the opposite. Wow, that's amazing. Okay, go ahead, please. Sorry, I was just being dramatic here.

I'm surprised. It's so interesting. So here's the reason. Think about like a great example of this is NotPetya, right? How did NotPetya start? M.E.Doc software that's created by Intellect Service, which is a family-owned small business in Ukraine that made tax software. That's not a big company. This did not start by targeting a big company. And how much stuff did it take down? One of the biggest cyberattacks of our time. The supply chain is everything in these conversations, and it is much easier to attack a smaller target than it is to attack a bigger one that has more resources. So I would completely disagree from the standpoint of small businesses or medium businesses not needing to prepare for this. Now, what I will say is it is extremely difficult to do that, and this isn't an all-or-nothing situation. Like, one of the things that I wrote about in the book and have written about in the past is like, do I think even the largest enterprises should be working on attribution? No. There's no reason that you should be dedicating resources to that. You know who should? Companies like Google, companies that can actually dedicate the time and resources and energy and also get paid to do that.

Mm-hmm.

Right? That's one of the biggest things to me is like, you have to choose where you're gonna dedicate your resources and time, and it isn't all or nothing. So, if you can't be focused on prioritizing nation states, If you can't have like an entire dedicated geopolitical risk team or do attribution because you're too small, that's understandable and you shouldn't be doing that. But what you can do is you can rely on your suppliers to be providing you that information. You can be using a service that's going to back you up and make sure that you have and are addressing the capabilities the way that you should. It's a consistent issue of trade-offs with what your resource constraints are and what you can do. And one of the things that I actually end the book with, because I think it's very important, A conversation around the fact that the data that these countries are fighting over, that these companies are fighting over, is user data. Users might not think their data's important. I have that conversation with people all the time, but countries think it's important. If there wasn't your data, there would be nothing to fight over. And so that's a big thing. If you didn't have people to manipulate, they wouldn't be doing it, right? And so that's a big thing to me, and I bring it back at the end because I, of course, as an analyst, have to try and give tangible advice if I can to, like, just use strong passwords, use multifactor authentication. If we had those 2 things, we would have a much more secure world. They're not big things, right? We can do those things if we dedicate the time to it. And they're not going to be these things that are like, oh, you're going to have to understand the threat actor fundamentally to make better decisions. They're just little things that you can do to enhance your security posture significantly. So, I kind of come back to that. You're more important than you think. And even if you do little things that seem small, they can have a huge difference in how effective you are.

So that's great. And I think it's a perfect segue into— we have to close this episode, and we close our episodes by asking for tangible advice. So 2 kinds of advice. One, do you have recommended reading other than your excellent book, Code War? And 2, for the CISO who wakes up and realizes that their adversary happens to be a nuclear weapons state, what should they do next?

So other than my book, I'll do a shameless plug also for my Substack, which, I'll be real with you, if you go and look at it right now, there's not much that has been posted there recently, but I have a good reason. It's because I was writing a book and because my full-time job is also writing, so I haven't had time. He's going to be coming back very soon. I will say the other thing is, like, I have a list of all of the footnotes that I have, which are, it must be in the hundreds. Like, I was obsessive about putting a lot of footnotes in. A lot of them are to Wired and articles from Wired. They do an incredible job. I think, of course, like, within the cybersecurity community, we understand what a great job they do, but it is just easy reading. They get a lot of really great details and they provide a lot of really good support and recommendations. So, that would be like a really easy one to do. There's a lot of books too. I mean, back here I got Countdown to Zero Day by Kim Zetterer.

Nice.

Amazing book. I've got Active Measures by Thomas Ridd, another excellent book that I highly recommend.

Oh, he's excellent.

Like, there's a lot of really good books out there, and I won't go through my whole library or we'd be here forever. But besides that, the advice that I would give to a CISO is to be at least having a strategic risk conversation around geopolitics right now, once a quarter minimum. That is the absolute minimum that you should be doing it, given the changing geopolitical situation. But you should be having that conversation with whoever or however many people are in your risk and cybersecurity apparatus and organization in your company, even if that is one person. But there's too much change happening here to not be having that conversation right now. That is the thing, like, as I was thinking about how I want to approach this year of, like, talking about the book, but also talking about the changes that are happening in the world, I was like, it's not like I'm going to be able to make a standard deck for this that I'm just going to be able to present every time I want to go to a conference. I am going to have to change it every week because of the things that are changing. And so, at least make a regular cadence, even if it is just once a quarter, where you can have those conversations and where you can make sure that the business understands what's changing and how you can adapt to it.

That is, I think, among our 270 episodes now, nobody has given advice quite like that before. And I think that's amazing. That is genuinely novel, genuinely useful, and so on theme for the book that you've just finished. Allie, thank you so much for joining us today.

Thank you so much for having me. This was so fun. Great questions, by the way. I love these questions.

Thank you. And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.