EP93 CISO Walks Into the Cloud: Frustrations, Successes, Lessons ... And Is My Data Secure?

Security.

Hi there. Welcome to Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, our Reformed Analyst and Senior Security Staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show and argue with us on Twitter as well, twitter.com/cloudsecpodcast. Anton, today is our 2nd CISO Meets Cloud. You won't believe what happens next episode. We've got Alisha today. What are we talking about?

Well, it's interesting because sometimes when you're at Google, you kind of assume everybody is cloud native, but in the real world, there are a lot of cloud tourists. I think I did coin the term. I'm not sure I copyrighted it, but we certainly see a lot of cloud tourists in security organizations. Imagine that. Your organization may have 50, maybe 100, maybe for some European banks, 500 years of history before they met cloud. They did security in the 1700s, you know? It was just very different, no cybers. But the point is that their security DNA goes way back. And suddenly, there's this new thing called cloud. So how do you deal with that? How do you adapt? How do you adjust? How do you transform? This is really tricky for many security leaders. So that's why the series.

Yeah, I can't imagine, especially a 500-year-old security leader. How do they adjust to cloud?

Well, that's a little pushing it. Maybe I overdid on the metaphor.

No, no, no. It's a great metaphor though. This episode is fun because this is the one where I also invented the term cloud expat.

Oh, it's like cloud tourist, but the other way.

Exactly. Somebody who grew up in the cloud and then had to leave, which is my experience whenever I talk to CISOs who come from the before times. So, with that, listeners, let's welcome today's guest. I'm delighted to introduce Alicia Cade, Director of Financial Services at Google's Office of the CISO. Alicia, thank you for joining us today. We were hoping we could start off with just the 30-second, and it doesn't have to actually be 30 seconds, overview of your journey as a CISO migrating to cloud. What was it like? Tell us about it.

So, first of all, thank you for inviting me. And my journey took many twists and turns, and prior to being CISO, I cannot forget That's my big part of my career when I was in a consulting firm, big professional services firm, and then CISO in financial services. And I will share, happy to share my observations with you through the whole scope of that journey. One common denominator of all my clients and actually organizations' journey was, of course, a drive to modernize. But there were always two sides to the coin. One side, which is the hunger from the business to explore, use the power of cloud, modernize, get to the market the fastest way, and make their products most competitive. And another side of the coin was technology drive to reduce cost, modernize, and end-of-life challenges. And sometimes those two sides of the coin meeting, and sometimes they were taking different journeys, but that's what my experience has been to date.

So, when you were at your last company, you were involved in a somewhat complicated cloud migration, correct?

That is correct. And maybe I take kind of my 2 last companies because actually I think that would be the most illustrative. So, I would say that was first journeys were driven by the business and really very quickly it became apparent that the old ways of operating, especially in the 3 lines of defense model, perhaps weren't fit for the fast cloud implementation. So the kind of traditional approach to cloud assessment, or let's say third-party provider assessment, kind of bolt-on at the end, was no good. And also what we have found that, of course, there's a lot of I would say governance, controls, compliance teams that need to be involved, not only CISO, but let's say second line legal as well, and data privacy, that really we should be working together, perhaps not like in the old traditional model where everybody does the assessment and everybody comes together. So what became very clear is that we have to break those silos and we have to work with the technology team and the business team from the start, perhaps not in every meeting, but together as one and learn together with it. And those were the most successful implementations.

How did you break that silo? Because that seems to be the magic thing, right?

Yeah. So first of all, you know, we had to feel the pain to realize that, right? And that pain was translated in us preparing to migration, but then at the end, getting our hands slapped and saying, no, we're not going to sign off because we don't understand. It quickly became, of course, kind of fight for survival in a way from the implementation perspective. And it got as simple as getting around the table together and really learning about the objectives and the controls, debating actually those controls directly with the provider and all the relevant control groups, including legal, including data privacy, and of course, CISO and second line. As we moved along. And because let's be honest, those parts of the organization, we all worked in the traditional premise, and we had to shift our thinking to another premise. And I'm afraid, as much as cloud migrations are very much about technology, they are also about organizational change. And with that come people as well, and of course, the process.

So, security organization was brought in kind of late, early? Just curious, because we've heard of cases from other podcast guests in the past that security may be brought in very late or kind of in the beginning. Like, how was it for your journeys?

The journeys, a long time ago when they were just starting, of course, the model of traditional kind of risk assessment is bring these guys at the end and tell us if we're meeting all the policies, controls. You get the tick, some risk is accepted, some risk is worked on and remediated. off we go. This wasn't good enough here, and we quickly learned that that was actually causing bottlenecks and delays.

Mm-hmm.

And I'm talking here, just let's say the initial migration. We can move later to actually how the cloud— what's needed from the risk organization when the cloud is operating. And basically, what needed to happen is much earlier involvement in the project. Right, even at the requirement stage, and perhaps not every single person on earth from control groups to be involved, but the key people at the right stage. So we worked very closely with our CIO's organization, and we identified actually the key programs, the key implementations, and we were there at the table in the discussions from, from the start. That was the change that was needed. And of course, at first, That eats your time, absolutely. But slowly, your team learns. Slowly, we actually also benefited, let's call it, from the open source control frameworks. And we're able to actually apply the frameworks and translate our policies actually in those frameworks to make sure we all have common language and understanding, and we're learning from the experiences of others. And then, of course, That encouraged debate and resolution of the problems as we went along. So agile, supporting the agile kind of decision-making.

Okay, so that actually sounds like you really did take this as an opportunity to do more than just update your technology. You also updated how you related to other parts of the org, and you updated how your own team operated, adopting a more agile approach. I'm curious, through all of this, the technology, the org, the process, the people change, What was the hardest part for your org? What was the single hardest thing going to cloud?

I think, Tim, you outlined it really well, like it was a rosy path. It actually wasn't, because what we ended up doing, even though we recognized the shift of mind and shift of doing things, process and people, was necessary, we started with basically proofs of concept, right? And proofs of concept, limited implementations that were corresponding to the business needs. But then the most difficult point was scaling it and going beyond those initial implementations. The reason for it, again, organizational construct. Very often, especially complex financial institutions operate on a federated model where divisions have got a lot of command and rightly to drive their technology. But at the same time, there is a certain backbone, which is central, and security certainly sits in there. And how do you balance, therefore, those needs of the divisions and perhaps the will to go to different clouds than the strategic solution supported by the center?

Oh, so that's how multi-cloud almost snuck in, right?

Yeah, multi-cloud model, especially Before you as the group have agreed what's going to be your strategic platform.

Okay. So can we just take a second to appreciate the irony of the fact that what you said was the hardest part of cloud is scaling? The whole point of cloud is that you can call an API and have arbitrary scale on your compute or storage or resources. So that's really funny to me that the hardest part was scaling, but the federation part of that makes a ton of sense. We've heard that in a lot of places. I don't think we've heard a good answer to how to make that easier for orgs. So, did you have anything that helped overcome that?

When I said scaling, Tim, scaling has different shades, right? This is scaling across the organization, saying, okay, if these are the applications that have gone into cloud and they are using the cloud model, can we do it elsewhere? And how easily can we do it elsewhere? Let's apply it. Let's make sure the new technology spreads. Right? You're right. The scaling in terms of technical capabilities, absolutely, that's one of the benefits and drives, but it was about organization accepting the change.

I actually believe Alicia here because to me, this is kind of, even at any kind of old school traditional org from a company that was founded in, I don't know, 1783, I can see there's always somebody who would rapidly adopt cloud. Scaling means It's not just about one guy in the basement who is forward-thinking, but everybody else. So, the scaling part to an org makes total sense to me, especially at a more traditional and very large org. So, it's kind of interesting. Cloud scales, but cloud doesn't really scale easily at a traditional org to use all use cases.

Exactly. That's the context. So, it's about the adoption of the change.

So, here's the thing. We asked about the hardest challenge, and this kind of makes sense in light of the context we got. But what was the biggest surprise? And again, given that the context cybersecurity, we're all holding our breath thinking Alicia would just share something truly horrible. But frankly, what about a good surprise? Maybe it was a good surprise. What was the most surprising from security point of view in your cloud migration?

I think as we all got around that table, right, and we started working as one team, the most surprising is how fast the lessons that we learned from, you know, the initial pains have actually taken us forward, and how people actually became the beacons of the change, even in the control functions, second line as well. It's really a fast realization that effective governance to fit the Agile model is a deal breaker here. So trying to remove the compliance security as the showstoppers, which are always kind of seen and perceived like that in a traditional model, but really work together and make sure that we are facilitating it. That was amazing. And the energy behind it, it created— that was the biggest surprise. And I would say that also has initiated a lot of learning for everyone and increasing the kind of the education and the culture. People, people realize that Okay, this is completely a new model and we need to upscale. We need to look at the, as I mentioned, open source tools, cybersecurity framework, the CSA Cloud Control Matrix, etc., etc. And let's work together and adopt it. And also let's make sure we suddenly, you know, the whole kind of chain reaction of what needs to be changed exploded. We need to change our penetration testing, for example, and actually how we assess the cloud. And then of course, if we adopt the cloud and developers are using it, how are we gonna be assessing the new solutions that are new applications that are migrating to cloud? Because the traditional approach to risk assessment of an asset is just not gonna work, right?

Yeah.

Things are moving much faster. So a lot of energy and a lot of realization that actually security and compliance, this is an opportunity for them to stop becoming the perceived showstoppers.

This makes a ton of sense. Now that you've mentioned tools and frameworks, that opens the door for me to shift us into a more tactical gear. How did your team go about designing security controls for the cloud? What did that process look like?

We have leaned very heavily on, I would say, the widely adopted standards. So we were already a NIST shop, NIST Cybersecurity Framework, but we also have been engaged very closely with Cyber Risk Institute. We also have worked, and it's not only the CISO team, also our security architecture team, with CSA Cloud Control Matrix as well. And rather than trying to make it fit into our, let's say, existing assessment, we really devised the assessment methodology for cloud. Now, again, a journey, because at first, you start, of course, with any supplier with a procurement-related assessment. So that was kind of, you know, easy because you do it here and then. But what was more complicated is actually how exactly do you assess the solutions, the applications, once the cloud is implemented. And that was the realization where perhaps the traditional policies, the way they're written and the way they're being used in traditional risk assessment, it won't it won't do. We really need to code it in. And that means the shift in terms of the skills, and actually, again, a closer collaboration with the developers and security architecture team as well.

Which, to me, kind of starts to realize that you are using some of the resources, you mentioned NIST, that are themselves kind of cloud, maybe not cloud tourists, but aren't cloud native. Let's put it this way.

Yeah.

I mean, I kind of used it as— Tim, you haven't heard me say that, but like a cloud tourist is kind of the opposite of cloud native, I guess. But you can be maybe a cloud immigrant kind of in the middle.

Just, I hope nobody ends up being a cloud expat and having to go back to on-prem.

Yeah, that's probably part of that metaphor that we are now officially pushing far too far off the rails. But how do you know these controls actually work well in the cloud? So, Sure. CSA, Cloud Security Alliance, Control Matrix, CCM, it's kind of designed for the cloud, so it's expected to work well. But did you do anything specific to know that the controls you're building actually work in the cloud?

So, we, again, pen testing was very important, and it is important, I hope, for anyone. But then also, you know, we have done a lot of experiments as well. And again, we worked with the cloud providers to make sure we leveraged the already the existing knowledge and benefit from their design. There's no point reinventing the wheel. The other thing, of course, cloud offers not only an amazing ability to collect data and logs, but also amazing ability to analyze that data in a very fast fashion, very unlike, let's say, the traditional environments. Of course, we leveraged all those advantages as well. But I would say, at the point when I left, that was still, let's say, work in progress. And I think it's a kind of state of the journey that we see in a lot of organizations, even in financial services. Some of those things are still not tied together completely, and there is still a lot of work to be done. But going to your points about NEST and other frameworks. Yeah, I agree, they kind of grew from non-cloud background, but I think it's been very helpful that actually they are providing guidance to the CISOs and other parts of the organization in terms of testing. And I think they're gonna— what's important to observe, that they have to continue to be refined and evolve.

So let's talk about that on-prem legacy. As you migrated to the cloud, how did you keep your team from lift and shift thinking? Anton and I spend a lot of time making fun of people with forklifts trying to come to the cloud, but in reality, it's a pervasive mindset in our world. Firewalls, perimeters, data centers we own and control. So was this part of your strategy to keep people from thinking that way? Was that important? Did you do this at all, or did that just happen naturally?

I think, look, for any CISO that has any consciousness, I think it must be a paralyzing thought thinking organization is going merrily lift and shift. And so of course it was important to me. And I think also what has helped together being on the journey with other control functions, including second line, you really get to very quickly understanding and sharing the understanding of the risk. I think as soon as you just go lift and shift, of course, your risk broadens, your ability, and especially in that federated, let's say, model, suddenly you cannot monitor, let's say, everything that you think you have. I mean, I know, let's not go there about the inventory.

Yeah.

That's another advantage of adopting Cloud, but let's say, suddenly, your footprint just spreads like fire, right? Because you cannot control it. So I think the education, let's say, from that has come from clearly highlighting the risks across the 3 lines of defense in that collaboration, and then making sure again that those risks were escalated, the results through the governance framework. And of course, the buy-in at the top, and especially in my last organization, it became very clear and We were very focused on actually, I would call it the productive, effective cloud adoption, which was paired with the organizational transformation, which is still ongoing, but it's the right direction rather than doing, you know, a few migrations here, a few migrations there, all to different platforms and just dealing with the applications being in the cloud. And the other thing is with that lift and shift, because of that education journey that we had together and breaking the silos, it also became clear that the question, do we make the new fit the old, or from the policies and controls perspective, or do we actually update and identify policy and risk management objectives and the model independently, and then gradually, let's say, the legacy from the governance perspective, gets modernized and brought into that new world of the new policies and the new way of working. And that was clearly the most productive model. But it's a long journey, which, of course, is still continuing.

So, let me ask one particular question, sort of from the, I guess, on the more tactical side. And it's very self-serving because of this data security white paper we've been working on. And at this point, Alicia should smile at least a little bit. So, How did data security practice change in those organizations? Like, when you moved to the cloud, what changed in data sec, if I may ask?

So, Anton, a couple of points. I give a secret out here that this is a subject close to my heart because I was responsible globally for data confidentiality. And maybe I also come clean here and say, given at what state of the journey we have been in my organizations, this is still work in progress. But, for example, what has become really clear clear is that there are examples where the cloud facilitates the shift that actually needs to happen regardless of the appetite for broader cloud adoption from, let's say, business reasons perspective. Although cyber risk, I think, is a business risk too. Manual classification, for example, of the data is no longer feasible and reliable controls and as well manual applications of policies more broadly, it's not going to do it. There is a need to really be sure where your most sensitive data sits because otherwise, how can you defend it and protect it? Data detection capabilities and also the powerful and fast scanning capabilities became really needed and became a priority to enhance our DLP roles. The other interesting side is, and it's also from the regulatory perspective in FS that your kind of traditional DLP approach is not going to really be sufficient because also the regulators expect increasingly correlation of events and a correlation of also the data classification and the data, let's say, paths in the organization location. So That demands access, that correlation to large datasets and really strong capabilities, analytics capabilities pairing with insider threat. So suddenly we have this huge contextual model that needs to be applied. And again, that requires the power, the real-time analysis and collection of data from masses of endpoints and then passing it through, of course, really good behavioral analytics to identify what's an anomaly. And that again can be changed and adjusted. So suddenly, you know, we don't have just the traditional DLP gates, and suddenly perhaps we have a blurring in between what's a DLP control versus What is data security controls? Because, and inside the threat, for example, because it's all an ecosystem.

I really like that idea of blurring. So now that we've blurred that line, I want to zoom us out for a second and ask you to answer briefly, very simple question. Is moving to cloud a net risk reduction? Simple question. Yes or no?

Depends.

Ah, it's a canopy. Canopy.

First off, canopy.

I think we can How about, can it be?

It can be both, depending how you do it.

Okay. Okay. That's a good answer. I like that. We've gotten different answers to that question. We've gotten, gotten yes, just a straight up yes. I think it depends is a good answer. It kind of reminds me of Harry Truman asking for the one-armed economist, but we don't need to go there today.

It really depends on how you do it. Yeah. If you're talking about the true migration backed with the organizational transformation, I believe it's a reduction. However, if you do lift and shift, if you do just fragmented approach and kind of end up running fragmented environment that doesn't actually bring modernization that's necessary for the security function to monitor, therefore your environment, of course you're increasing your risk and it's not I think that's a great and true answer.

So, Anton, you want to close this out today?

Sure.

So, our traditional closing question is recommended reading. Anything you want to point people to? I picked on the Cyber Risk Institute because I've only heard of them. I've never dealt with them. And of course, CSA CCM. But maybe you have other resources you want to recommend. That's one. And the other one is one tip for CISOs encountering cloud for the first time.

I think The reading, something that caught my eyes, Priyanka Vergadia, Visualizing Google Cloud. And I think although it is specifically Google Cloud, it really gives a good overview of principles of any cloud. And it's got lots of nice illustrations. The other reading, something slightly out of the box, which is Cyber Politics in International Relations. By, I think the author is Nazli Chowdhury, if I pronounce it right. I will send you the link for that.

I will find it. Perfect. Yeah, we'll find it. Thank you very much for this.

And the tip for the CISOs going to cloud, don't think just technology, think people and organization and your processes as well.

See, I love all of these answers. I so often say CISOs don't need another security tech, they need marriage family counseling. And I love that you recommended a cyber politics in the IR space book because fun fact listeners, I was a political science major in college.

That is fabulous.

Perfect.

All right listeners, with that, thank you so much for joining us today.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter @anton_chuvakin and _timpego. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.