EP76 Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of the cloud security team here at Google. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered to you piping hot every Monday afternoon Pacific time, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we're talking about security for SaaS today, which is kind of like cloud security, but for software in the cloud rather than, well, cloud in the cloud.

That's a very cloudy explanation, frankly. I think that for a decent number of people, Their first encounter with cloud is in SaaS, right? They use some kind of online service. I don't know, Google Workspace.

Or perhaps Gmail since 2003.

Gmail.

Thank you. Exactly. So—

So how do I secure Gmail? Is that the question? That's kind of the question.

Oh, no. We have people who do that. You know that, right? And AIs, by the way, too. We talked to some of them.

I think we've talked to some of those people and some of those AIs.

Exactly.

But this is actually— I think this is a really interesting episode because there's a lot of attack surface out there that you can't protect or instrument the usual ways. And so we're going to hear some interesting stories of how they've started to do that for their customers.

And one of the more famous, or maybe I should say notorious, Gartner acronyms will make an appearance.

Oh, no.

This was one of the first 4-letter acronyms that got wide adoption, and that's CASB, C-A-S-B. I've met— you know, you're making a face.

I am. Listeners, I made a face.

I do not know, or maybe I suppressed it in my mind, I don't know the story behind CASB acronym being coined, but I have a suspicion there was something at least somewhat vile was involved because who would call a security product a broker? What do you call it, a dealer? No, that makes no sense.

Well, listeners, perhaps with that reflection on the art or dark science or necromancy of Gartner naming, let's turn it over to today's guest.

I'm delighted to introduce today's guest, Ben Johnson, CTO and co-founder at Obsidian Security. Ben, thank you for joining us. We are seeing a lot of attention on SaaS security lately. Isn't SaaS security kind of like 2012?

Well, first of all, thanks for having me, Tim and Anton. No, it's actually a hot area because, you know, I think in the last 10 years, while a lot of the security investments were focused on-premises or devices or that sort of thing, our businesses Migrated everything to SaaS. And now everyone's realizing that the target is SaaS. The journey will end in SaaS. And so, SaaS security is hot, and we're excited to be part of it.

So, I still feel like when I hear about SaaS security, I still— my mind pretty much just goes to CASB somehow. And maybe that's an elephant in the room. So, would you be able to kind of quickly explain how is your technology different from what a CASB would do? And again, my comment about— our comment about 2012 was kind of about when CASB was born, became hot. So, How is it different from that?

Yeah, so I think first of all, and would love your perspectives to my comments here, but, you know, CASB came out when everyone was realizing how much they didn't know about their environment in terms of what SaaS or what cloud was being used. And so, you know, I've heard it put, CASB was actually designed to slow down cloud adoption, which I mostly agree with, but it was really about like—

I think that's just straight up true.

Which I really do think that, you know, really it was about who is going to the cloud, who is, you know, sort of transporting or, you know, sort of on the highway to get to these off-premises environments. But CASB doesn't really think of, at least in general, and CASB is a big, you know, broad market with a lot of different nuances and stuff, so I don't mean to put everyone in the same bucket, but a lot of times CASB isn't looking at the SaaS app as the noun, like as the thing to defend. Right? It's really what's going to the cloud, what's coming from the cloud, but it's not really looking at what's going on inside the cloud or inside of SaaS, like that inside-out view. And so that's really how we focus on it. We focus on the SaaS app itself is the thing to protect. And yes, you have to look for people, you know, logging in and data moving out and things like that. But the actual, like, surface area, like, thing to defend is the SaaS app itself.

So to summarize that, it's the case that you're defending the inside of the SaaS app, not defending the enterprise from accidental shadow adoption of the SaaS app.

Yeah, and I think when you get down to it, you know, CASB has certain use cases that are, you know, maybe a little bit different than ours. We tend to really think of ourselves as 2 halves of a coin. First is, you know, you guys would appreciate this, EDR for SaaS, right? That continuous threat monitoring, who's attacking it.

Oh no, I think EDR— I just have to go cringe and like pull my hair out about EDR for SaaS. I'm gonna cry about this one.

I'm gonna say EDR to SaaS next time I want to break Anton's brain. Like, I know that's catnip for him. It's gonna break him every time.

I couldn't come on this and not say EDR. But anyways, it's, it's who's trying to attack from a threat perspective, the SaaS app, and it could be insider threat, or it could be external threat. That's half of it. So threat management, right? Detect, respond, that kind of thing. I'm sure we'll get into that. The second half is the posture is the weakness. Like, what's actually configured in the SaaS app? How hardened is it? Those kinds of things. And I feel like that's where, you know, CASB kind of missed the mark. They're not really looking for compromised accounts, and they're not really looking for, you know, misconfigured security settings and things like that. They focus on maybe on DLP or on shadow IT— some good use cases, but, you know, I think a little bit different than what we're focused on.

You know, I think that it's as they say in all those Buddhist stories, and then he got enlightened. I think that your point, the point you made about CASB being born to kind of protect enterprise from the cloud, is kind of a big deal because I think that's what happened. I remember, I think I wasn't at Gartner when CASB was being created, but the vibe I felt in the air, it was very much protect enterprise from all this scary SaaS that people buy with their credit cards. This was the At least the founding DNA for CASB was this. It wasn't to secure the SaaS app. It was to secure the enterprise from the big, scary cloud in the form of SaaS. And this may— I think I got it.

Yeah, okay. I think I get it too. But let's take another layer deeper. What are the actual threats that you're looking for in SaaS?

Oh, this could be a long conversation. But—

Just give us top 50, top 70, maybe.

Yeah, I mean, so first of all, SaaS itself is a very broad area, right? I mean, you know, an HR platform is very different than a productivity platform, very different than a customer relationship management platform or whatever. But, you know, I think first and foremost, it's about making sure the adversaries are not getting in. So, you know, anomaly detection, threat detection, that kind of thing. You're trying to figure out if accounts are being compromised, but then you're also looking at Not just phishing attacks and things, but it could be malicious OAuth apps. We're starting to see a spike in that where, hey, if I get you to click on the new Google Drive beta app, which is actually my fake app, then I don't care if you have MFA or anything else, right? I'm in. And we can talk all about OAuth and that kind of thing. On the insider—

You haven't come up with some horrible variant of the word phishing to describe that? That's not a—

Oh, phishing? Sufficient? SaaS phishing? I don't know. Phishing?

I think that's sufficient, but why don't you go on?

Yeah, no, for sure. You know, and then once people are in, then there's all sorts of, you know, techniques, right? And, you know, I think MITRE and others are trying to work on the SaaS version of ATT&CK and that kind of thing, but it could just be simple business email compromise. It could be full-blown source code theft. Those kinds of things. It could be sharing all your documents out. I think fortunately we have not seen too much destruction yet, and I think that part of that is maybe because the SaaS providers themselves could help counter that by maybe having backups and things that are not accessible to the attacker. But then you get things like token theft. We've seen an uptick in session hijacking token theft, where if I get your Okta token or your IDP token, I'm in, right? I'm into all your environments, and it could be man-in-the-middle, it could be browser compromise, but we've seen them for sale, you know, on the dark web and other places. And once I'm in, then, you know, now I'm into your on-premise apps maybe or whatever because I got through your IDP. So, you know, I could talk a lot more, but, you know, I think there's a lot of things that are very similar to what we saw in endpoints or other areas of attack. They've just morphed enough to target SaaS.

So we sometimes say how in the cloud, identity is kind of so central, so critical, but here, it's almost like it's the only thing. Sure, there are vulnerabilities in SaaS, there are exposed APIs, but the role of identity in this is like even more central. It's like overwhelming presence. You mentioned tokens, credentials. It all rotates around identity.

Yeah, yeah, yeah.

That's really interesting.

So it sounds like it's really hard because securing public cloud in the form of infrastructure as a service, you're ultimately securing, well, 3 platforms, us and the other 2 guys, right? But in SaaS, you're securing—

800+.

800+ different things. So, it makes me kind of scared a little bit for your sake and for Casby's sake. So, what are the actual challenges in securing SaaS apart from the sheer number of Well, SaaS.

I ache for your PMs who have to prioritize all those. Like, that sounds terrible.

They're gonna love your empathy there. Yeah, I think—

PM job number zero.

Yes. You know, I think my biggest surprise in the last 5 years of working on this problem is how disconnected the security team typically is from the application owner. Like, I've run into teams where they have to beg during an IR for Office 365 logs because they have no access. Like, the security team is just kept out, right? And that's usually one of the ones that they have more access to compared to like an HR platform or sales platform or some of these others. So I can get a little more technical, but I think to start with, it's kind of like ownership and who actually is in charge of the security of these applications, of these SaaS environments. And it could be from the threat and more security operations side. It could be from the GRC governance side. It could be from, you know, just kind of the hardening and kind of maintaining a sort of standard posture side. And so, I think first and foremost, it's really like ownership and bringing together multiple parties, which we've had to do a lot with our customer engagements, right? And it does, you know, I think it forces some good conversation. And then you start to talk about, yeah, the diversity, the entropy, the logs in maybe one of your platforms are very different than the logs in some, you know, other platform. And everyone, you know, names things differently. And unfortunately, we didn't standardize 10 years ago. And so now it's just exploded. And some people, it's XML, and others, it's JSON events, and others, you have to run PowerShell to enumerate configuration settings.

Or download PDFs sometimes.

Yeah. You know what I call that problem, Ben? I call that the Anna Karenina principle of clouds. Every happy family is alike. Every unhappy family is different in their own way. Every cloud logs in their own way. It's just different.

But for SaaS, some don't log at all.

The other thing Ben was saying, though, there, which I think is really interesting and a theme we see a lot, Is that the teams didn't even have cooperation, right?

Correct, correct.

Like, Ben, you're almost describing not selling a technology but selling like marriage family counseling services there, which I always say would be a great security business but not a very high multiple on exit because it would be services, not technology.

Yeah, for sure. I think you've put it well. And everyone we run into wants to do the right thing, right? I mean, the people that have the least security knowledge but maybe are the admins for certain, you know, platform or SaaS, you know, they want to do the right thing. They want to help. They want to, you know, keep attackers out. They want to harden all of that, but they're more incentivized by uptime and availability. You know, kind of the classic tension between productivity and security and that kind of thing. And then security wants to do the right thing, but they don't feel ownership or they have no access or, you know, they know they're going to get yelled at if they, you know, lock out the CEO or something from his or her email or something like that. So, you know, everyone wants to do the right thing, but yeah, that's a challenge. And I think especially without true framework around who should own these things, as well as without a technical standard, it just means that people like us have to do all sorts of crazy work to try to analyze all the information and then boil it down to threats and risks.

And presumably, there are also people who treat SaaS security as kind of a paper/contractual problem, right? At least with infrastructure, you assume that there's infrastructure security, but I've met enough people who think that SaaS security is not even about CASB. It's about the right checklist they send to the vendor. So, like, there's that angle, which to me, in my mind, doesn't make your job any easier, right? Because they think SaaS is secure because they signed the paper. How common is this, or is this hopefully mostly gone by now?

I think it is shifting. I think you're completely right, but I think it is shifting where that shared responsibility model, everyone focused on the other side, right?

Yep. I like that. Shared responsibility model, it's the other side.

That's the magic. You know what we call it?

That's terrible.

We call it shared fate. We've tried to play up that term, especially internally in your enterprise, because, you know, if something happens, it's on security, it's on the app owner, maybe IT, you know, somebody else. But yeah, I think we're seeing it shift where you do need the contractual things in place, protections in place, where if the SaaS vendor gets compromised, you know, under the hood, or, you know, there's a privacy leak or something like that, that you know how they're going to respond or what they're liable for. But again, to sort of beat a dead horse, like, you have so much responsibility yourself. Who's accessing it? Who has credentials? How are you configuring it? What are the clients used to access it? And we are seeing people wake up a lot to that, but it's still a little earlier, I think, in the journey.

So we sort of started with this whole elephant in the room being CASB. And in my experience, back in my analyst days, CASB has been the fastest-growing security market. As far as I recall, it was the shortest time to Magic Quadrant in history. And of course, a lot of people kind of equate securing SaaS with using CASB. And in the beginning, we sort of talked about how the DNA of CASB being in, like, at this point, 10 years ago, is different. But imagine that I'm a customer and I've deployed a market-leading CASB and I did the discovery, did other stuff, and maybe it's an inline API CASB. I don't know all of that. What am I missing if I assume the box is checked? I got CASB, I deployed it well. What am I missing?

Yeah, it's a great question. And I don't mean to put everyone into the exact same bucket because I do know there's—

It's okay. We don't have a CASB product, right? So it's okay if you beat a couple of CASB vendors up, right?

Sure. I think first and foremost, it's like, is this a tool that is actively being used by your security team, like day to day, right? Because a lot of times what we see is it gets set up almost like a firewall, right? Because it's more focused typically on control versus visibility. And then the security team's not really using it in the day-to-day needs, you know, visibility, investigation, threat hunts, all these other, you know, areas. And so then when you start to talk to the organization about, well, you know, how is your SOC using this? Or how is your IR team using this? And typically the answer is they're not. So then the question is, well, what are they doing? And it's like, oh, well, in addition to the CASB, we're trying to pump all these like raw logs to a SIEM or something like that, which is, you know, it's okay, but then you're forcing all these people to be experts in these various SaaS logs and try to build detection rules and things like that. So, you know, I think really on the threat side, it's really about, you know, sort of those optimized threat detections, optimized triage and response. And then I can certainly talk a lot about posture management and hardening, but, you know, I've probably said enough already to hear what you guys have to say.

No, Ben, I love this answer because we were arguing at lunch about whether it was better to be the produce section of the grocery store Or the frozen foods aisle. And what you're describing of these detections ready to go for the different SaaS things out there, that's the frozen foods aisle in our lunchtime argument. And I really love that because I'm a frozen foods vendor as well. And Anton's like, oh no, everybody wants to cook from scratch. I'm like, no, no, no, my friend, nobody's got time to cook. Who's got time to chop up the lettuce? They just want to eat dinner. So let's get them a delicious and nutritious meal that they just pop in the microwave.

True.

My argument was slightly different. I was pointing out that everybody wants to modify what got shipped to them, not cook from scratch. But this to me is a subtle— it's a debate we've been having for a good number of months at this point. And at this point, at some point we'll have a podcast episode where we argue between ourselves and then only the detection literati would care about this. But at least the point is there. It's really hard to build good detections for the top 800 SaaS security problems, right? I don't see an enterprise doing it. I can see the vendor do it. So I get that. I see this guy doing it.

Yeah, yeah. And I mean, it's— there's a lot of work that goes into understanding, you know, the different events and just sort of what's normal, right? So then you can even start to baseline and look for anomalies and that kind of thing. But then, yeah, the whole like hardening and posture side too. I mean, typically, I don't think CASB is focused enough on where are you weak in your configurations. And then we haven't even really talked about things like admins and overprivileged users, because that's also an area I think that that CASB didn't really or doesn't really typically address is, tell me who has too much access and, you know, who's not even using their access and those kinds of things, because that's a huge concern as well.

Yeah.

And then once you start looking at who's not using their access, you can get into cost savings for people, and there's lots of nice stuff there when it comes to per-seat licensing.

But I want to talk a little bit about the architecture for all this.

When you guys plug in, are you inline like another network appliance? Are you API-based? How do you get this thing up and running? And How do you show users that quick time to value that everybody wants in a security product these days?

Yeah, well, fortunately, I had years of asking everyone to install endpoint drivers and agents.

That's like the ultimate torture. So everything is easier by comparison. Come on.

Is that where all his hair went to, you think?

That is. And so—

Every time you ask to install an agent, you lose another strand.

Yeah. And so with this one, it's all API. So we joked about OAuth before, but we're typically an OAuth Onboarding process, a couple clicks, and you're already pulling information, pulling logs, pulling other data from the, you know, the SaaS API. And, you know, typically in a 30-minute call, even a very large enterprise is onboarded. So we really took that rapid time to value to heart. And everyone wants a quick win, right? No one wants a 12-month security project. Everyone wants a quick win. And so you have to have that rapid onboarding in order to get there.

Shinran and Hassan must love that.

They do, yeah.

So it's interesting that when we talk about this, the challenges you encounter when securing essentially 3 IaaS applications versus securing 800 SaaS applications are quite different. So securing IaaS has spawned the whole ecosystem of things like there's CWPP, CSPM, and many of these have ambitions of also securing SaaS. Do you think they're a bad fit? Do you think that vendors who secure IaaS wouldn't barge on the SaaS turf and develop presence there or not?

Do you become a feature in one of these other products? Do those other products become a feature in you? What's the future look like? Predict things.

That's easy, right?

Well, first of all, I have to say, I think it's going to be really exciting to see how all this plays out because IaaS, SaaS, et cetera, I mean, that is the future of I mean, you all shipping Chromebooks and things like that, right? I mean, it puts all the defenses on the cloud-based assets and services. I think one of the challenges for the IaaS vendors is that— and it's the same on the SaaS side, but on the IaaS side, it's a moving target. So you're protecting your guys' cloud, the other providers. Like, you're adding more and more stuff, so they have to keep adding more things to You know, defend or detections or whatever.

That's where my hair goes.

And, you know, with any company, you sort of get your center of gravity. And so their center of gravity is building a company of DNA that's focused on IaaS security challenges.

Infrastructure, basically modern-day infrastructure, not modern-day applications, business applications. I would buy that. Like, their DNA is in securing not infrastructure like OS and routers, but infrastructure of the cloud. But his job is securing applications and that may be different. I don't know, trying for that argument.

Yeah. And I think, I think, you know, we're, we're really focused on SaaS. And so we're seeing the huge diversity and entropy among these different SaaS apps. We're, you know, hiring experts who are, you know, lifelong like ServiceNow people or Salesforce or those kinds of things, where some of these other companies that might just be, you know, GCP or your, your other providers out there in terms of the technical backgrounds. But yeah, I think there'll be some collision at some point. And, you know, we all just have to move fast and make sure we're focused on the right problems and then, you know, sort of see how it plays out.

That's the fun thing about being a startup, is you get to focus.

I mean, so basically you're saying time will tell who would be the solution for securing SaaS, whether it's going to be CASB.

Oh, he didn't answer my question at all.

He dodged. Yeah. I mean, I can see 3 forces, right? Like the CASB guys, people securing IaaS, special providers, this whole CSPM thing, which I'm still kind of parsing in my head, would clash and it'll be fun to watch for us, right? We are paid regardless because they use GCP on the backend.

Well, I think what we're seeing is, and maybe you're seeing this even more than I am, is that all the CASBs or most of the CASBs are moving to the SASE, get even more traffic through your devices, your brokers, et cetera, double down on that. Whereas we're not trying to do that. We're more on the visibility side. They're more on the control side. And then you see the infrastructure, you know, sort of vendors battling it out as there's more of them and they're raising quite a bit of money and things like that. And then in the SaaS side, you see other startups and things too. So it's really developing its own ecosystem. And then you see SSPM, SaaS Security Posture Management, and I'm sure we'll get some other terms before it's all said and done too. So yeah, it'll be really interesting to see how this all plays out.

I actually really liked that point about going for visibility as opposed for Getting in line. I think that's such a better position for so many reasons. My first team here at Google actually is exactly that way. And our stickers for that team say equo elapso, which is Latin for with the horse having already left the barn. But I still think we're making fun of ourselves. I still think though, despite that joke on ourselves, it's the right way to do it. So I really admire that approach.

Yes. And at the same time, I can see how you mentioned sassy, right? SASE essentially marries CASB, which is about the cloud, to secure web gateways, which is about like freaking 1980s. So you sort of marry a web proxy from the mid-1990s to CASB, and you get something that may not be future-looking, right? Well, if you focus on securing SaaS, you don't have any secure web gateway luggage to carry.

Is that like tying a rock to a brick and hoping they float better that way?

That's a little too cruel, but like, yeah, it's kind of tying a modern polymer material to an ancient Roman rock, more that. But okay, fine. So we beat on this enough. So I think when I was looking at your website, you kind of mentioned CDR and not just—

CD writable?

CD, yeah. Well, I'm not that old. I am that old, but like, yes, no, no, not that. And once I tried polling on Twitter whether people actually think we need a CDR now that we have EDR, XDR, and to an extent, NDR. And suddenly somebody shows up and says, I have a CDR. And I'm like, no, no, no, no. So how do you justify— do you think we need CDR? Do you think CDR is a good idea? Or do you think it's just stuff for Anton to make fun of? I don't know.

I think you need technology that's optimized for different parts of your environment. And so, you know, in the endpoint world, we saw EDR where we really had to generate specific sensor data for Windows, Mac, Linux, whatever, that was different than just like a Windows event log or something like that, right? And I think you see the same thing with SaaS, where you really need to understand the logs and try to optimize them. You're going to see the same thing or already see the same thing with IaaS, where you can shove everything into a generic, you know, area. But it comes back to that, like, you need optimized detections, you need optimized workflows and response and that kind of thing. We called ourselves a while back, CDR because when you'd go to explain to someone what we're doing, kind of to your first points on this show around like, well, wait, CASB, SaaS, I don't get it. It's like, no, no, no. It's like, as soon as we said CDR—

He's going to say it again. My brain would explain again. He's going to say EDR for the cloud, but SaaS.

He's going to go. He's going to go first.

I was.

I was.

I was.

But as soon as you went to someone who's using a Carbon Black, a CrowdStrike, a CyLance, or whatever, you know, technology, and you said, oh, we're like that, but we're CDR, they'd be like, oh, I get it. Right? But the challenge is, I think the word cloud has come to mean to most people public IaaS cloud, not SaaS. And so when we called ourselves CDR, very quickly it would go down into IaaS. And we're like, no, no, no, no, no, it's, you know, SaaS is part of the cloud too. So we moved away from that. But it really helped, I think, prospects and customers and partners and everyone understand what we were talking about. It's like, no, no, this isn't CASB. This is really a continuous security monitoring type of play, or EDR for SaaS, I got to say it. But again, we've since added posture and hardening and those kinds of capabilities as well.

Ben, I hate to say this because this has been one of the most fun conversations we've had on the show in a long time. Like Anton and I are dying over here. We have to ask the closing questions. First, do you have one tip to improve your SaaS security, either threat side or posture side? And then 2, recommended reading. And I hate asking this today because this has been too much fun.

Oh man.

I think the challenge is both of those questions, boiling them down to one answer. So.

I think you can give 2 answers. You don't need to give one answer. There's no bonus points for that.

Okay. I think on the SaaS side, maybe I'll give 2 types of an answer. So one is like, you got to get your security team with access to your SaaS apps, right? So more on the sort of relationship side, the process side, like, you got to get access to that, right? That's number one. Number 2, on the technical side, is just There's so much going on that you don't understand in SaaS. You got to figure out some way from a technical standpoint to get visibility, which is why I started with number one. Like, if you don't have access, you can't have visibility. Maybe I'll throw a third part in there just to give someone an answer they can act on right away. But I think if you can harden the entry vector through maybe turning off OAuth apps or making sure SSO and MFA are enabled, You got to do that. And I know to some people, maybe that's Security 101, but it's still hard for a lot of organizations to get 100% coverage on things like SSO, MFA. Watch out for those backdoor accounts that somehow don't go through SSO, you know, those kinds of things. And I know that was like 5 answers there. On a reading, you know, I think, I don't know if you're asking more broadly, but, you know, we try to put out blogs and things like that around, you know, around SaaS security and just other security topics. MITRE is doing some work. With a SaaS version of the ATT&CK framework. CISA just put out SCUBA. I don't know if you guys have heard of this.

SCUBA?

Yeah, they just coined the term SCUBA, which is Secure Cloud Business Application, which means Google Workspace, Microsoft 365, et cetera, SaaS basically. So they just put out SCUBA. And then if people are looking for a book recommendation, my favorite book is Essentialism. Has nothing to do with SaaS security, but it will help your overall It's like EDR for your—

Life.

Life.

Thank you. Well, I'm looking forward to taking a deep dive on Scuba.

You should. It goes deep.

All right, Ben, thank you so much for joining us today. I've enjoyed this conversation. I hope you have. Listeners, I hope you all have.

Thank you so much. I had a great time.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter @anton_chuvakin and _timpeako. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.