NEXT Special - 6 Cloud Security PMs (and a Developer Advocate!) Walk into a Studio

Security.

Hi there. Welcome to the final bonus episode of Next 2021 by the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as they've been all week and always will be, are myself, Tim Peacock, the product manager for threat detection here in cloud, and Anton Chuvakin, a reformed analyst and member of the cloud security team here at Google. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered piping hot every Monday afternoon, please do hit that subscribe button on your app of choice. You can follow the show and argue with us on Twitter as well, twitter.com/cloudsecpodcast. Anton, this is our final next episode, and it's a little bittersweet to be wrapping up the week. It's been so fun. This is our 4th of 4 bonus episodes this week.

Indeed.

And this is the first episode when we had 9 guests.

I think it's 9 including us.

9 including us, correct. But this was kind of mind-blowing that we made it all work. So maybe the audience does not want to hear us lamenting how hard something was. You just expect magic. But we did have to combine 7 people, you know, with opinions, with views from different areas of Google Security team, Google Cloud Security, product managers, other people, and kind of get them to deliver a coherent episode with 7 guests. This was magical.

I think what was fun was how much things converged. Like, we didn't plan the convergence, but at the end, all the PMs were like, oh, I could summarize it this way, I could summarize it that way. I thought it was really quite a nice set of interactions from everybody. And I know it's a longer than usual episode, listeners. So with that, let's turn it over to our first guest today. Our first guest today, host of Security 212, Stephanie Wong, a developer advocate here at Google. Stephanie, you're talking about data center security, and you're actually the only Google colleague I've met who's actually been in one of our data centers. Can you tell us about your session and tell us perhaps what was the most surprising thing when you actually physically visited one of our data centers?

Yeah, so my session is about lasers and night vision cameras and military-grade fences. Well, no, but it's not too far off because as you all know here, security is one of the most critical elements of our data centers and our Google Cloud workloads. And we have dozens of data centers globally. And so security operations means managing this massively complex network. So yes, I was one of the rare Googlers to visit one. And so my session is about this journey that I took to the core of a data center to show viewers, which I took a video of, to show them the 6 layers of physical security designed to thwart any unauthorized access. And so in my session, you're going to be hearing about how those layers transcend into Google Cloud's logical security controls that make Google Cloud one of the most robust enterprise risk management platforms. To answer your other question about the most surprising thing, as you know, there is multi-factor authentication involving even biometric scanning. So I had to get my irises scanned, and there were also vehicle crash barrier systems. Fences with fiber detection for motion, circle locks that I had to step into. But even any of those weren't the most surprising thing I had to get used to. It was actually just the rule that you couldn't tailgate, or you had to prevent a vehicle or individual closely following you to gain entry into a restricted area without a badge access. So, if the system detected a door open for too long, then it immediately alerts security personnel. So, I had to get used to badging and then letting the door close behind me, and then vice versa if I was following someone in. And I would consistently get the door slammed in my face. And it was just very abrupt. Wow.

So in light of this, I just want to ask my favorite question that I've been asking people all over the place about the threat models. Of course, we can all guess what type of threat models they imply in a physical data center. Of course, data theft, maybe hardware theft. But what's the number one threat model we are most worried about when it comes to security of our data centers?

I mean, unsurprisingly, in this case, it's physical access. And the reason is because once you have physical access to a hard drive or a machine, then a lot of the bets are off. If I can scan a hard drive, then I can brute force decryption keys, plug a thumb drive in, I can do a lot of damage. And my colleague Seth actually came out with a great analogy. And, you know, if you had a Wi-Fi access point in your building, you can't really do much with it if it's on the ceiling. But if you bring it down and you have it on your desk, then suddenly you can do so much more. You can stick a paperclip in the reset button, you can provision custom firmware, and you can connect directly to it. And so the threat model completely changes, and that's difficult to protect. We do have protections in case, like secure boot mechanisms. We have TPMs to make sure hard drive and hardware hasn't been tampered with, but it gets much harder to protect when it's in someone's physical case. And I guess the other question is, are people trying to break into Google data centers? The answer isn't no. I can't provide details there, but even our colo facilities have the same level of security because this security is so important. You know, customers trust Google with their data. If that was breached, then that erodes trust. And recently there were actually 3 major independent security breaches targeting companies of the size of Google. So there's no question people are trying to gain access to our data centers or to data centers in general. And that's why we have these protections in place.

That makes a ton of sense. So I'll close with our traditional closing question, and everybody else on this episode can prepare for our traditional closing question. Do you have recommended reading for the audience to follow up on this topic?

Yes. Well, first off, I encourage everyone to watch the video that I take you on this journey. It's at bit.ly/6layersdeep. 6 is the number, 6 Layers Deep. And then also read up on our security whitepaper, which dives into our security culture and internal privacy and security events. including testing tools. I'll also say check out the Security Foundation's guide and blog post to learn about how you can use an automated approach to security on Google Cloud using Terraform scripts to do things like IAM resource hierarchy and deployment, key and secret management, and more. And I also have a Security Command Center video series.

Ah, that you do.

So I'm going to just barge in and we're going to travel from the journey of physical security to the realm of ransomware and cyber resilience. So the other guest pair is for Security 101, Sec 101 session. It's Vicente Diaz, returning guest who we had on our podcast and also security engineer. The other person is Jerome McFarland, solution manager and PM, not in the centrifuge, PM rotator, whose session is called Ransomware and Cyber Resilience. So talk to us about the session. What's your session about?

Our session covers a few different topics. You know, we provide an overview of the ransomware landscape and how that's evolving. including some data on the prevalence and evolution of recent ransomware threats. And we also get into guidance and best practices to help customers think about and prepare for ransomware recovery. And then finally, we also introduce in the session a cloud-integrated approach for helping the customers to actually implement and achieve speedy recovery from a successful ransomware attack.

That's awesome. So everybody out there surely who hasn't been living under a rock or asleep for the past several years, knows what ransomware is. Why are organizations still paying so much for ransomware? Why are these gangs so successful?

I can understand the incredible amount of pressure that you have to take a decision under such circumstances when you are losing how much money per minute, right? When you're shutting down production or when your company is not working. So what to do in this situation? It's really hard because if you didn't do your homework, Basically, you don't have many alternatives, and that is a real problem. So of course, we are not encouraging to pay these gangs because this is only making the problem bigger. But the reality is that once that you get into this situation, there are not many things you can do to recover your data unless you work to prevent this situation to happen.

That actually makes sense. And here's the funny one. I was on a customer panel a few weeks ago, and somebody asked a question from the audience. The audience question was, How do you handle this if your insurance company, your cyber insurance company, actually forces you to pay? And that froze everybody on the panel because everybody was like, oh my God, that hasn't happened to us, but can it? Why are they asking this question? So it was really this kind of scary thought that just hit 3 CISOs in their heads who were on the panel. Like, wait a second, what if the insurance company tells us, what are your damages if you pay? $30,000. What are your damages if you don't pay? $3 million. Okay, we'll pay $30K. Give it to the attackers. So I freaked out myself. I like, I wasn't sure what to tell them. Any advice here?

You shouldn't pay. Now let's get real. In this situation, what to do? If you already have this cyber insurance, you'll save the day just like that. But this is just making the problem bigger. The reality is that these groups, they are getting more and more resources. And, you know, we are thinking about them like just this gang of kids trying to get some money. But in reality, If we put this in perspective, how big is the problem and how much money they are making, probably is one of the most lucrative businesses in the world. And these are well-organized gangs with a lot of resources. We are just making this worse. And then this money can be used in other criminal activities as well. I mean, we are talking about criminals here. So I'm not sure this is a wise decision.

Yeah, it's not as if these guys are donating the funds to the local charity org. They're doing not good things with it. Having the insurance company make you pay, that's a little bit Like when they total your car instead of letting you get it fixed, huh?

Yeah, but in this case, it's your IT infrastructure. That's a scary thought. Let's switch to a more optimistic topic. How is ransomware different in the cloud? We seem to be pretty safe from it, but is this a reality? What have you guys seen in your research?

Well, I mean, from my perspective, I'd say kind of the key difference when you're thinking about cloud and ransomware is that the cloud gives you ways to better protect yourself against the impact of ransomware by either preventing the attack or mitigating the impact of a successful attack. And so spanning across cloud, there's lots of different domains where those kinds of protections can help you. Within Gmail, there's built-in protections to help you prevent malware infections. And technologies like BeyondCorp have zero-trust access architectures that help limit kind of the scope that an attack can take if it's successful. And all those kinds of things, I think, help to mitigate the impact and to mitigate the prevalence of ransomware attacks. And a lot of those technologies are unique to cloud.

But you wouldn't say that you are completely safe from ransomware once you adopt GCP or any other clouds? You wouldn't say the problem is fixed? You would say it's easier to fix, but it's not like completely fixed?

I would never say that you're completely safe from anything in any scenario. You're just begging to be proven wrong.

A wise security person. Thank you very much for this. So we don't really have much time left, but like any favorite reading? I hear you have a great report coming out soon.

I fully recommend our VirusTotal ransomware in a global perspective report. Plus another recommendation, which is called Our Mathematical Universe, which is what I'm reading right now.

Amazing. That sounds almost as philosophical as our Karl Popper suggested reading from a previous and recent episode. With that, I want to shift gears and talk to Scott Ellis, one of my favorite PM colleagues here at Google. Scott, you've got a session, Security 204, on protecting your sensitive data. It's maybe self-explanatory, but tell us, what's that all about?

What we think is, you know, visibility into your sensitive data is crucial to really understand, you know, what you're at risk for. And what we're going to talk about in this session is some of the tools that we have and some of the new services to really help, like, automatically give you visibility across your entire organization into your sensitive data so that you can better secure and protect your data. This is a real challenge of customers really of all size. You know, data is one of the biggest driving forces of small, large, and all-sized companies, enterprises, And as that data is growing, what we often hear is this notion of known unknowns and unknown unknowns. We're really, as data is growing, don't always have that visibility into like what's there, where is it, how's it being used. And if you have those unknowns, it's really hard to govern and protect your data. And so one of the things we talked about in our session is around this new service called Automatic DLP for BigQuery, which really helps address this by running at a higher level. So it runs across your entire org. automatically inspecting your existing data, existing projects, datasets, tables, and new ones as they get created. So again, you're getting that sort of monitoring and governance. And it's available now for BigQuery.

Anton's going to show up with a favorite threat model question. You probably already guessed it. So for automatic DLP, what are the threat models we are assuming? Again, is it compliance mostly? Is it data exfil? So what sort of key problem or key threat we are addressing with this new technology?

You can look at most security threats you're trying to protect against are really to protect your data or your sensitive data or the things you really don't want to be exposed or misused. And so we'll give a couple examples of those, but if you think of the risk of an incident like an unintentional disclosure, you know, for example, someone shares, you know, a dataset not realizing that it has sensitive information in it and it gets exposed to someone who shouldn't see it. And you really need to know where your data is so you know you have the right controls in place to prevent that kind of exposure. Without going too far and hindering your business, right? You want to have that good balance of, you know, security, but also ability to operate. And so when you know your data, you have visibility into it, you can protect against those sort of unintentional disclosures. Another one to consider too is just the risk of insider threat. You know, knowing that you have the presence of sensitive data, it can ensure again that you have the right access controls in place, and that you have extra monitoring of access to that sensitive information. Or where you need to do things like obfuscate your data so that the risk of that disclosure is minimized. And again, data obfuscation, masking, tokenization, that's something that, you know, our DLP platform can also help you with. But ultimately, it all starts with visibility. You have to know where the information is before you can make a decision on how to protect it.

That makes a ton of sense. And there are some really cool capabilities in BigQuery for in-place tokenization and masking and really giving fine-grained access control. You know, when we were doing a demo together, I was blown away by all the capabilities there. So we'll wrap up with our traditional question with an addendum, which is first, what's one thing an audience member should take away from your session? And 2, recommended reading.

One very specific thing is this is now available. You can go and try it out yourself across your org, org folders, or projects just to gain visibility into your data. So definitely check that out. So one takeaway is again, like, make sure you're paying attention to your data and use these tools so you can gain that visibility. For additional reading, find out more information about this, you can check out more at cloud.google.com/dlp.

Perfect. And the next speaker is for a session SEC207, Patrick, who is a senior PM, and the topic is securing the supply chain. Again, that's a very fun topic, and we had a whole episode on that before the event that Google has run on container security. So it sounds like a very fun topic, but at the same time, it intimidates a lot of people. So, what aspects of supply chain security are you addressing in your session, Patrick?

What I'm going to focus on are the key principles for what it means to secure your software delivery process more generally. For example, what does shift-left security strategy look like in practice within your SDLC? And how can enterprises go about establishing trust early on in the software development cycle without compromising speed, of course? Also, I talk about verifying and maintaining that trust all the way through deployment and runtime. And a lot of these concepts are pretty straightforward for those that have been involved with security practices, but may not be top of mind for those for whom security isn't primary for their role. For example, developers and other DevOps roles. It just may not be something that they're thinking about. They have probably some basic practices that they've already implemented, and they figure that that box is checked. Well, as we found out through CodeCove, SolarWinds, and a variety of other recent hacks, that the entire supply chain has multiple attack vectors that have to be addressed. So throughout the discussion, I illustrate how customers can start pulling these security practices into their particular process and how they can use GCP to do that. And then we have Dustin Ingram, who gives a really great demo of how you can configure a secure deployment pipeline on GCP Mm-hmm. Using Cloud Build and Binary Authorization Tool. And what this does is essentially it ensures that only builds that have a specific authentication from your build system that can be verified and show that this is the build that you intend to deploy, and that no one has interceded or injected anything bad into that deployment to your runtime. So, we give some really good examples in the talk, and then Dustin gives a demo. So, we hope to just kind of bring these concepts kind of home in a very tangible way so that teams can start to practice them.

So wait a second, a demo of supply chain security? That sounds really cool because for a lot of people, supply chain security is a very amorphous topic. So you can actually show supply chain security being done in front of their eyes, right?

Correct. We're going to show one very specific practice that goes a long way to improving your overall security posture. As many of us know, that security is not any one thing. It is a layering of things that you do. in any particular area of your tech stack. So in this case, we talk about gating the deployment to authenticate the build and ensure the build integrity. And then there's a variety of things that you can do to keep moving left along that pipeline that can provide deeper attestations and provenance and things that you can verify against and bring alerts and know if something's wrong or if there's a vulnerability that's being introduced, for example.

That's awesome. I love the Binary Authorization product in part because it's, you know, so inspired by how Google does it. ourselves internally with all of our beyond-prod principles. 2 things before I ask my next question. One, you need to put a dollar into our podcast acronym swear jar. What is an SDLC for people not familiar with that?

Sorry about that. Yeah, software development lifecycle.

And then 2, you have to put a dollar in our CodeCov SolarWinds swear jar.

There is that, yes.

But I'm actually required to say that in every public forum that I speak at now.

Oh no. Well, on the topic of putting dollars into jars, we're making a ton of investments in this space as Google. What's the one thing you're most excited about to see Google doing in the secure supply chain space?

Well, first of all, I think it's very powerful when someone like Sundar publicly commits billions of dollars to cybersecurity. I also think it's important that we put our money where our mouth is and we quickly show what we mean by that. So, I think the work that we have done, that we are doing, and that we'll continue to do around open-source security, in particular, things like the Open Source Insights service and the deps.dev site, which we're going to be integrating into our commercial products for securing artifacts, I think that's very exciting because it takes these really core concepts in the open-source space, and we're able to kind of work them into our products and basically indoctrinate best practices into our commercial products for teams to use. I also believe very strongly in the work on the SALSA standard, or S-L-S-A, which stands for Security Levels for Software Artifacts, rather.

That's my favorite acronym.

Yeah, that's another acronym. And I'll put the dollar in the jar there.

It makes me want some chips.

Yeah, exactly.

I love that one.

Wait, wait. I thought it would make you wanna dance. This sounds like a healthy alternative to chips, right?

I'll do both.

Do we also have a guacamole framework?

We're working on that, but that's super secret.

Ah.

And very spicy. So this set of standards has actually been part of the executive discussion with the Biden administration and his agencies where, you know, the recent announcement around security requirements for government agencies and those that do work with the government, they're saying specifically that you have to provide some verifiable security around your actual software delivery process. And what Salsa does is it attempts to actually create a framework of how do you, in layers, you know, level 1, level 2, level 2, level 3, level 4, how you can start to step up your security posture by doing certain things and having certain practices. And eventually, this will be kind of a fully auditable standard, which may become part of other standards such as FedRAMP and so forth. So, I think the thought leadership that Eric Brewer and his team have been doing in that area is really spectacular, and I think it's really helpful to the industry. And it's also guiding a lot of the work that I'm doing on the commercial side in terms of building this into our actual toolset for practitioners.

And listeners, we had Eric as well as Aparna on our podcast several episodes ago talking about exactly this topic in greater depth. So in addition to checking out Patrick's session at Next, you should also check out our previous episode, Linking Up the Pieces: Securing Your Supply Chain. With that, I want to turn things over to 2 of my other favorite PMs. I think I'm going to get in trouble if I keep calling all of my PM colleagues my favorites, but it's true. Security 300, Ilsung Lee and Anoush Sobhory, both PMs here, Removing Implicit Trust in Google Cloud with Ubiquitous Data Encryption. That title is a mouthful, but I think that the concept is not so complicated. And this is very much back to the beginning for us. Our first ever podcast episode was with Nelly talking about confidential compute. So this sounds like a much more end-to-end experience around that. What's your session about?

You know, originally the title was actually a little bit longer, but marketing may have shortened it. So if you can believe that, Anton, if you remember a while back, right? I mean, last year you and I published a whole series of blogs around the trust paradox, right? And so those blogs talked a lot about how for customers to trust Google and other cloud providers more, they need to actually reduce the amount of trust that they put inside the cloud provider. So we've taken that idea even further than this, you know, about cloud EKM, allowing you to encrypt with the key outside, or, you know, using confidential compute that allows you to encrypt your data in use with a key that's generally protected with a key that's not controlled by Google. But rather, our talk is really focused on the concept of ubiquitous data encryption, which from our point of view is just simply the ability to seamlessly encrypt data at rest and use in transit using keys that are under the customer's control. And obviously this opens up a whole new set of use cases for customers using our cloud That's excellent.

So what's the actual threat model you're addressing here? Because I hear a lot of encryption, encryption here, encryption there. What are we really protecting against?

That's a great question. Like Ilshang mentioned, the goal we have here is to help customers increase their trust by reducing the implicit trust that they have in cloud and having more control over access to their data. This is very useful in things like reducing risk to accidental data leakage, for example, due to a bug in the code, or even an unauthorized insider access. Now, we've always had encryption capabilities for the— all 3 states of encryption. For example, we use TLS when transmitting data to the cloud or encrypting the content when stored in the cloud, but they were more or less disjoint. Google had to be involved in bridging the gaps. What we're going to demonstrate in our talk is the fact that this is not the case anymore, and there's an approach that you can achieve ubiquitous data encryption with a key that is fully in your control and not the cloud provider's.

But to kind of drill down a tiny bit here, this sounded correct and adequate to me, but it didn't sound very specific in terms of use cases. So if I run a bank and I face my threats typical to a bank, do I need it? If I run a, you know, a chain of gas stations, if I run an e-commerce shop. So I'd love to know more about the specific use cases.

Oh, absolutely. So the way to think about this and the way we kind of target our persona was around customers with very sensitive data and workload. that runs in a VM, and they face high level of security and compliance requirements that perhaps have stopped them from moving to public cloud. With ubiquitous data encryption, we're trying to provide an option for such customers to reconsider cloud as a way to do compute. Basically, if you want to reduce the implicit level of trust in cloud, this is something that you should consider.

Okay, that makes sense to me. I think with that additional clarity, I think it's more useful. Traditional final question with this. Any favorite reading? What sort of things users should learn to make use of this new technology?

Check out the Trust Paradox blogs that was published around this context. Extremely insightful way to think about trust. The confidential computing product page will have updates and documentation on how to turn this feature on. And we do plan to publish a companion blog that discusses in more details, which we encourage you to read and have a look at, and there'll be more links in there.

There's always the additional information we have around how we do encryption in the cloud, how we actually secure all the other assets and such. And if you do read the Trust Paradox blog and put a comment in there, I promise Anton's going to respond to you personally.

It's very likely, yes. So thank you very much for all the guests. So I feel like we should probably start a quick discussion on this. We're not going to do a vote about which session was audience's favorite and stuff. But like, it's interesting how Google Security covers such a huge range of topics from encryption to access control to, well, physical security. So it's interesting. We only touched a few sessions. There's this whole invisible security stuff. There are sessions that, you know, Tim and me are doing on security operations stuff. But it's kind of amazing that it's all one Google, Google Cloud with that range of security offerings and innovations. It's kind of cool.

And it's remarkable to me that of the people in this room, I have ongoing product integration discussions with a lot of these people. Like Google Cloud Security covers all these diverse areas, but it all also comes together.

Make a note too, when Ilsung and Anoush were talking about, you know, some of the stuff they're doing around encryption and confidential computing is that's also something that like was really relevant in our talk. Wow, we actually include a bit about processing data confidentially and things like Confidential Dataproc and using these confidential VMs. Kind of the heart of it again is once you have those sensitive workloads and you know where they are, we want to make it easy and effective for you to be able to process that data. So it's not about just saying no to something. It's about getting understanding of your data so that you know how to do it right. Again, I think to your points there, just how these things connect. And even in this discussion here, you know, I started to think about from Stephanie's talk and Patrick's talk, you know, you talked about the data center and the software development lifecycle and the supply chain and everything. All of that is relevant to everything that you do. One of the things that came to mind, and it just sort of wanted to, you know, put a shout out to some of the notions we've talked about around like invisible security and seeing that vision come to life a little bit To me, it's the idea that the security's just engineered into the platform, that you don't have to think about as much of the overhead, but you just get all of the benefits and the outcomes of security. As a user, as a customer, what I, what I think that means is you can just focus on the security outcomes, but ultimately focus on your business and not thinking about all of the overhead just to get security running. It's just engineered in, it's built in. And to me, that's one of the things that really connected when I heard everyone talk here, right? I'm thinking about the data center access and how that is. super protected, you know, lasers and this locking door and everything, right? And then how the Secure Boot and everything coming out of making sure that things are running right, all the way to, you know, what we're talking about in our talk about getting visibility into your most sensitive data, but then these awesome tools to protect against it. And then ultimately, you know, making sure that you're protected against things like ransomware. I mean, to me, all of it was super diverse, but really comes together to say, focus on your business. And make security built into the platform. So, I don't know, that was just one thought that came to mind that really excited me about everyone's talks here.

Yeah, huge plus one to that. I was just going to follow up and build off that, that one theme I didn't talk about in my initial intro here was that I do cover this transition into not just defense in depth physically, but it happens on our stack as well. And as Scott was saying, the whole point is that we want to make the move to the cloud that you have. confident for you. All the measures we have in place between Security Command Center, between the infrastructure below that, all the way up to the application and logical layer of your stack, we're trying to make it as easy as possible, even if there are different responsibilities that you have based on the workloads that you're deploying. But we're still trying to make things very transparent. We have access transparency, access approval, a lot of measures in place. And even so, the security blueprints I mentioned are here to make your experience built on Google Cloud with best practices in mind.

I would additionally add that, you know, as we kind of talk more and more to our customers, we're seeing them move towards taking everything that they have and pushing it up into the cloud. There's this tension that's established, right, between people wanting to use the cloud and take advantage of all the elasticity and the scale and computational power, but at the same time, you know, the ability for them to actually still feel comfortable with all that, right? And so I think that one of the things that's very prevalent in the things that you've heard today is the fact that GCP is a cloud where we keep on pushing the boundaries around how much you can actually start using us for some of these things that probably a few years ago you never would have imagined using us for. And I think that that's something that you're going to continuously keep hearing from the talks at GCP.

Well, that is a remarkably optimistic note to end on, that we continue pushing the boundaries of what's possible for a cloud workload. Everyone, thank you so much for joining us today. This was, I think, a delightful subset of all the great work, really. Thanks for having us, Tim. Yeah, folks, this was great. Thank you for putting up with our crazy experiment of a panel session. This was fun.

And now we are at time. Thank you very much for listening and of course for subscribing. Please go to the event page for Next, cloud.withgoogle.com/next, and watch the presentations of our today's guests. The links are in the notes. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcasts, or you can follow us individually. Well, actually you should do all of it, @anton_chuvakin and @TimPeacock. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. Now go watch various Next presentations, And of course, see you in the next Cloud Security Podcast episode.

Security.