EP31 Cloud Certifications, and Cloud Security with TheCertsGuy

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Tim Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and a member of the cloud security team here at Google. You can find this podcast wherever podcasts are sold, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content, please do hit that subscribe button. You can follow the show and argue with us on Twitter as well, twitter.com/cloudsecpodcast. Super stoked about what we're talking about today, Anton.

Well, the big idea is, of course, cloud security skills and certifications. To me, one of the challenges I've encountered in some security teams is that they have security skills, But they don't have cloud skills. So to me, that's how you build this whole lift and shift, a favorite topic on our podcast. And that's how you end up replicating your on-premise environment in the cloud. So what they do need, it seems, is a good way to get skills and of course certify them if their employees are asking. So the books or any kind of guidance to get certified with cloud is extremely helpful, including for security professionals.

So this is really how do we get out of the lift and shift jail? This is like how to start thinking with cloud. That's an awesome topic then. All right, so with that, let me introduce our guest today. Super pleased to have you on the show. His name is Iman Ganazadeh. He is a Solutions Manager for Security Operations and Analytics here at Google Cloud. Iman, welcome to the show, man.

Hey, Tim, great to see you. And Anton, gotta watch out for you sometimes. I mean, after all, you have the knowledge to do the exact things that I have built a career defending against.

So Aman, what's this book? The title is a mouthful. I'm going to try to get it right. Google Cloud Certified Professional Cloud Architect All-in-One Exam Guide, First Edition. What's it all about?

You missed cloud in there somewhere, right?

No, that, that had the right number of clouds. So what's the book all about?

You're probably familiar with the All-in-One series book, especially if you have a career in cybersecurity. You've probably read the, you know, the CISSP All-in-One series book. It's one of the most famous technical certification books. But this book specifically is directed to help people pursue a path getting certified in Google Cloud. And a Google Cloud Architect is not just a role. Anyone can kind of assume the role of an architect. And a lot of the audience behind the certification may come from various different backgrounds, from sales teams, engineering teams, product teams, legal teams. I mean, there are so many different people who can benefit from this content. And getting certified is not just about learning what it takes to take the exam and pass it. Really, it's about trying to build the real-world skills of a Google Cloud architect, understanding the implications that, you know, driving and building highly resilient, highly scalable architecture has in the real world, and obviously building architecture securely right from the start. So, I had a couple different goals for this book as I was writing it. So, first goal was I want everyone who's reading this book to be able to really understand beyond the technical components of this book, understand first what the philosophical impacts of this role are. As technologists, you know, we have some of the most powerful roles in society. I mean, virtually this entire world operates off of technology, right? So, like, first and foremost, as you know, you're doing your role in society, whether you're on a sales team, whether you're on a product team, Part of this book is really understanding how the natural evolution of technology has driven us to this cloud-first world and how much impact we have in our roles as cloud architects and beyond. And second was really helping people build that real-world understanding, like, what are some of these use cases specifically in real-world scenarios? So, like, in my previous role, I was in the professional services organization. And I worked on a lot of enterprise security transformations and enterprise cloud transformations, first and foremost. And really being able to put into perspective, like, this isn't just an educational book, right? This is a book based off of real experiences dealing with clients, dealing with stakeholders in meetings, and really just sharing all of that insight throughout the book. And then obviously, you guys know, I come from a security background. I actually believe that, like, the whole concept of shift left is not just a technology concept. It is also just an education and enablement concept. If you think about it, at the beginning, before any pipeline is built, before any code is written, there are humans behind the scenes that are designing systems, and they have to design these systems securely. So, I use this book as an opportunity to take a lot of that security knowledge that typically doesn't scale when you just have a security architect in your organization, and shift all that back into all the folks who are pursuing cloud architecture so that they understand that this is actually a responsibility of us all, not just of our security counterparts. And that, yeah, those are sort of the key premises that I had in mind as I was writing this book.

Being a book, it sounds like a large endeavor. And of course, I recall back to my years when I've written a book about security, it was a long and fairly painful journey at times Maybe tell us a bit more about the journey. I mean, the book seemed to be targeted towards cloud architects, but you, of course, come from a security background. So, how was the journey, and how was your security background a key factor in writing it?

So, it's funny because when this whole book came to be, it was actually one of my, you know, customer engineering counterparts on a previous engagement had connected me with another individual who was asked by McGraw-Hill to write this book. And He was like, hey, Iman's got a bunch of certifications and he probably might be interested in this. And, you know, I never imagined writing a book. I mean, especially not at this age. I figured that was something I'd do like, you know, maybe 20 years from now or so. You know, one thing led to another. I talked with McGraw-Hill, I pitched them an outline, I got Google on board. And after we got into, you know, the writing phase, I just sat down and I was like, okay, what the hell do I do now? And so, you know what it's like when you start this massive endeavor, you have this vision in your mind, but then when you have to break it into actionable steps, I think really what helps is starting with a really good outline and thinking about the story you're trying to tell, right? And a lot of times when you read a lot of technical books, you know, it's gonna dive right into some concepts without really sharing context on, like, what the concept is and where it plays a factor in your job and in your life. I think the one thing I sort of tried to achieve here is I wanted to tell a story from the point of, like, signing up for Google Cloud, Here's how you sign up for GCP. And from the start, you have to build a highly resilient multinational enterprise cloud architecture from the point of like, you know, signing up and, you know, connecting your IDP and setting up, you know, cloud identity and all that stuff to building your network, to designing your access management hierarchy, getting through all the various chapters, embedding security content in each one, best practices from the field. And then finally getting towards the end where I have a dedicated security chapter where I summarize all of the content from earlier chapters, all of the best practices into like an infrastructure security highlights section, and then dive into security operations. Because I think that fundamentally there's 2 big objectives of a security team. One is the security of the infrastructure and then is, you know, detection and response, right?

With all this and, you know, you've got, is it 14 certifications?

Yeah, 14, 14 so far.

Yeah.

Is this like a real number? Wow, 14, and they're all current? You keep them all current?

So I have this big beef with the whole CPE system. It's like, come on, we're already in this industry. We do so much work all day, and then we have to go every year and put in all these CPE hours. So I prefer the certifications that don't have CPEs. I do manage to keep them current, thankfully, because my employer pays for them. But if it wasn't for that, I probably would have let them expire by now.

So we've got 14. They're mostly in security. I get both perspectives on this one. Some people are like, certifications are useless. Some people think they're super important. Where do they lie on this, you know, obviously crazy spectrum?

A couple different thoughts here. So first is like, I can empathize with both perspectives. If you just dive into a certification path, you are not probably building the real-world skills needed to actually collaborate with your teammates at an organization. and solve challenges, right? But if you are so heavily focused in on all of the real-life technical skills, sometimes you seem to forget how this all fits into the bigger picture. So I like to think that security is a way to build theoretical knowledge with a low barrier to entry, right?

Mm-hmm.

It costs $60 to buy a book, $120 to take an exam, and you get to build some of these like theoretical concepts You pair that with a lab, you probably get a little bit more hands-on work, probably not like direct customer or project-related work, but it helps you become a better communicator in your job. And I think that's something that we all kind of lack in, in the cloud space and in the security space is that too many of us are too focused on our certain specialization of work or our subject matter expertise. And it's kind of like school in a way, right? Elon Musk hates school, right? Of course you can become the best engineer in the world if you just dive right into engineering. But all those various little topics that you pick up and you learn little tidbits of, all those things help you think and rationalize about all the different people involved in building a product or a solution or solving a challenge and help you become a better communicator because you're able to understand many different perspectives. Especially of technology. And a lot of times security folks, you know, we've got such a massive industry, right? You can't really be a jack of all trades unless you dive into reading, unless you dive into books and you start to expand your mind beyond just being an analyst or beyond just being someone that, you know, really knows network security really well and et cetera, et cetera, et cetera.

So they're a good way to broaden things. One of the challenges we have in the industry is like the workforce gap or the lack of cybersecurity professionals to fill Do certifications help by giving a path in? Do they hurt by gatekeeping people out? What's the intersection of those 2 problems?

You know, let's unpack a couple things, right? In the security space and in the industry overall, we're going through this big, massive evolution in the workforce where you've got some very highly talented people that job security is no problem for them. They can pivot from industry to industry. And then you've got this young growing class of folks who are trying to figure out how they can get into tech. And for a lot of people, you know, they don't understand cloud or they're starting to learn cloud, but they don't understand the fundamentals of IT because we're not in the world of doing fundamental IT anymore. The world is kind of evolving from that, right? So you've got 2 types of people here. You've got the purists who have done this for a long time and who think that this fundamental knowledge of, of IT is really effective and it makes you a much more effective cybersecurity expert or cloud professional. And then you've got this new rising class of folks who are just diving straight into cloud and trying to figure it out. But I think your question was around, does certifications make this industry more accessible?

Yeah, that's really the heart of that question.

Again, so I mentioned earlier that certifications offer theoretical knowledge at a low barrier to entry, right? So again, it costs $60 to read a book. Surely you're not going to be an expert of everything, but you know what? It'll help you become a better communicator. I know for a lot of people getting into the workforce, when you go into your interview process, your interview process is all about how you communicate about topics, right? It's unless you're doing the coding exam for, you know, for a, for a SWE job, you know, oftentimes you're really just tested on how you think and how you communicate about problems and how you understand problems and whatnot. And so certification is kind of offer you that very unique access to understanding how the technology works, what it sort of means in the grand scheme of things, and how you can sort of become a better, more effective communicator about the topics that you're discussing. I mean, I'll give you a great example, like in security alone, like 30 years later, we've still got people that are discussing what a threat and a vulnerability is.

Yeah, my favorite guy, right?

And it's like, hey, like this is like basic, like security Yeah, I have seen that on the teams I work on.

Can I please unhear it? Because yeah, I'm gonna go on an hour-long rant if you guys don't stop this with this topic.

There's a couple other factors here that also make this industry more accessible, right? So certifications also offer diverse and underrepresented groups access to learning, right? So like me, you know, I'm Afghan American. I was born here. My parents came from Afghanistan. You know, they came to this country without anything. We didn't have a computer. Thankfully, I had an uncle who's been here for a little bit longer than us, and he gave us a computer when we were younger. But you can imagine how many people in the world don't have access to tooling and technologies. But it's very easy to sort of provide text, provide books, and offer a path to sort of getting certified, right? And so for a lot of people that do come from backgrounds that are underrepresented, maybe it's a bit easier for them to sort of dive into content because it's lower cost, because it's more accessible and build those skill sets. And obviously like tech, you all know this, there's a world for everyone in tech, right? Whether you're super technical or whether you're a marketing person or a legal person or a salesperson, there's a world for everyone here. So it's not so much about does this industry need to be more accessible? It's about how do we make it more accessible and create paths for the people that need it most. And certifications can really, really, really help there as well.

I really like that argument, actually. I really like it. It sort of reminds me of another episode where somebody defended compliance as a way to sort of set the foundation for knowledge for things to do. So, to me, this is kind of a little bit analogous, I guess, is that compliance in a good way is a uniform bit of stuff you need to do. And here is the uniform bit of knowledge you have to learn. Would it be exactly perfect for the real world? Maybe not exactly perfect. But would it be useful if you don't have other choice? Absolutely.

And listeners, that is the Tim Dirks episode where we get compliance's building codes analogy.

In the book, I talk a lot about bridging the gap, right, between all the different people you work with. Because the reality of our workforce today is the challenges that we're faced with, they require everyone. They require people from every background in the world to come together and creatively problem-solve. I was at this talk a couple of years ago, and one of the individuals said that creativity is going to be one of the most in-demand skills in the growing time because we need to look at problems from a very different perspective, out of the box, right, to be able to solve them. And if you think about how cloud technology is sort of revolutionizing the way we live, more and more and more, as people As people get more integrated with computing, with technology, as our human evolution sort of drives to this state where we really live in this technology metaverse, we need people that come from all walks of life to get involved, to get into tech and make it accessible and make it simplified so they can get in, their feedback can be sort of preserved and captured in the development of society and evolution.

So in light of this discussion, what are some of the biggest architectural challenges you've seen in the field of cloud security? How do you architect some of the preventative controls? How do you fuse it with security operations? So, how do you build all that? What are the biggest challenges you've seen?

One of the constant issues I see, sort of, people don't really understand how there's a separation of the security that you bake into your cloud, right? As well as the security that you offer to detect and respond to threats in your cloud. Right. So, when it comes to architecture, right, we like to think of things that shift left into the pipeline, doing infrastructure as code, policy as code, et cetera, et cetera, et cetera. And I think one of the most challenging things about the cloud migration for a lot of organizations is a lot of people don't understand the shared responsibility model that well, because they're so used to doing things in their old school IT way on-prem, when they have full control over everything, all their network logs, logs, all of their telemetry, all their data, all their infrastructure, everything. And so, when they come to the cloud, they kind of want to extend that same control in the cloud. But I always like to say, like, you first, like, really have to understand the value of the shared responsibility model, right? Because if I'm able to dish off things to managed services, you know, then I can focus on solving other problems. So, like, the encryption conversation is an easy one, right? Everyone wants to sort of own their keys in the cloud, but then they come to Google Cloud and they're like, hey, Google Cloud offers server-side encryption, encrypted at rest. Like, maybe I don't need to sort of manage this myself, right? Maybe I actually get to take my workforce and have them focus on other problems we need to solve. And if you think about the concept of defense in depth, right? The concept of defense in depth is that if you are doing a really good job securing one thing and that thing wants to fail, well, Well, you've got a lot of depth in your defenses. And so I like to get everyone to think about how can you shift more of your responsibilities to your cloud provider so that you can take your time and your engineering headcount and your resources and focus on bigger challenges because there's an endless amount of those possible. So I think the biggest sort of architectural challenge I would say is probably just a general lack in understanding. understanding what the shared responsibility matrix is so that when we do design proper requirements for our infrastructure and doing infrastructure as code and policy as code and all of these things, understanding where we really wanna focus our time and efforts on versus balancing it out with the responsibilities of the cloud provider.

So, if I were to summarize that, I could say cloud architects may have a tendency to get hung up on the shared responsibility model and not instead see it as an opportunity to shift the responsibilities to the cloud provider and let their teams focus on the things that are particular to their business.

Totally. And there's also this other thing I see very, very commonly, which is like DevOps teams are usually heavily involved in the cloud transformation, but security operations teams are not because security operations teams, they're like, wow, this sounds amazing. We wanna be involved in this. Google Cloud journey, and then they're like, oh shit, like we've got an incident, we're battling, we're underwater, right? And so like, Yep. You know, this is very common where like security operations gets deprioritized in the sales cycle. And then once we get to implementation, that's when security operations is like, wait a minute, we don't have full visibility over all these new cloud logs. And by the way, we don't even know what all these logs mean and how we're supposed to sort of build our detective capabilities and whatnot, right? So, Understanding like what the core responsibilities are, how you can sort of involve everyone into the process when you're going through this massive evolution in the cloud and actually carving out dedicated headcount from the various teams, from the architects that need to design best-in-class preventative controls, from your security operations teams that need to be able to gather all of the logs they need to build highly true positive correlation rules. for all of their potential incidents and whatnot.

That makes a ton of sense. So, we've got just a minute or 2 left, and so these are the lightning questions now. One, do you have a practical tip for architects to improve security?

Yes. The practical tip is what I said earlier, right? Like, use managed services where possible. I mean, look at Google Cloud's customers, right, for case studies, right? You don't need to do everything yourself. We're in a whole new world. You've got so many other bigger problems to And the world is changing very, very, very fast. The way we use technology is evolving our lives. So the old school way you used to do things, don't try to bring that mindset into the cloud. Think about how you can shift more of your responsibility to your cloud provider, because they're actually contractually obligated to provide you the best-in-class security. They're contractually obligated to sort of be on your side through this journey. And so where you can, hand off the responsibilities, use managed services, focus on building high-quality products, and focus on driving impact and changing the world, because that's the whole reason why the cloud migration exists. All right.

And with that, listeners, we are at time. Thank you so much for joining us today. Aman, thank you so much for being a part of the show. Really delighted to have you on. Listeners, we will have the link to the book with the title too long to include in the closer by name, but it is the Cloud Architect Book for Google Cloud. Thank you so much for joining us today. You can find this podcast at Google Podcasts or wherever you get your podcasts. If you like the content, please do hit the subscribe button on your podcast app of choice. You can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. You can follow us on Twitter, twitter.com/cloudsecpodcast, @anton_chuvakin, and @_timpeacock. Tweet at us, email us, argue with us. If we like or hate what we hear, we might even invite you on the next episode. And with that, we'll see you on the next Cloud Security Podcast.

Security.