Cloud Security Podcast

🚀 Should Kubernetes Security Be on Your 2025 Cloud Security Roadmap? 🤔 The rise of Kubernetes has been nothing short of revolutionary. But as we look ahead to 2025, a big question looms: Should cybersecurity leaders bake Kubernetes-specific strategies into their security plans? We spoke to Shauli Rozen, CEO and Co-Founder of ARMO about this. ✅ Why Kubernetes has become ubiquitous in production environments. ✅ The evolving perspective: Is Kubernetes security just “cloud security”? ✅ Real-world insights: When 100% of workloads run on Kubernetes, does your RFP even call it out? Many companies aren’t thinking about Kubernetes security as a standalone priority—it’s simply a part of the larger cloud security puzzle. But should it be more? Should your team look at tools like eBPF or specialized Kubernetes approaches? If you want to dig into some of these topics, you will find this episode quite insightful. We have linked the full episode in the comments below! #cloudsecurity #cybersecuritypodcast #kubernetessecurity

🎄 Happy Holidays everyone! and Thank you for an incredible 2024! 2024 has been such a crazy ride, we have had the opportunity to speak to some many incredible humans and share knowledge in various forms and every 5 years on, it feels truly incredible that we have had the support of so many on this mad journey. You all make every bit of hard work that goes into this a true joy and a absolute pleasure. So here's wishing this beautiful community a amazing holiday season, time doing everything you do with those you love and an incredible start to 2025! We got some amazing and exciting things planned but for now - lets take time for ourselves and those we love and cherish! #happyholidays

🚀 The Future of AI in Security: A Transformative Moment for Developers & Defenders? As we count down to 2025, a throwback to our conversation with Michael Hanley, CISO at GitHub then to understand how AI will impact the world of cybersecurity and developers. 🔑 Why security still struggles in 2024: Organizations are still playing catch-up with "basics" like patching systems and enabling MFA. The complexity of foundational tasks makes them harder than they should be. 🤖 How AI is rewriting the rules: AI tools, like your always-on, security-savvy co-pilot, are already preventing vulnerabilities during code creation. Developers can stay in flow while getting real-time security insights. This isn't just about productivity; it's about fundamentally transforming secure software development. 💡 What excites us about the future: AI-powered leverage could tackle technical debt retroactively—fixing issues we never had the bandwidth to address. We’re at the beginning of an era where security becomes seamless, integrated, and proactive. 🎙️ It’s early days—but the possibilities are massive. Curious about how AI is turning security challenges into opportunities? You will definitely find this episode to be quite interesting, we have linked the full episode in the comments below! #cloudsecurity #developersecurity #aisecurity

🎙️ Your Data is Your Business: Are You Protecting It Like You Should? 🚨 If you lost all your data tomorrow, would your business survive? 😟 For most, the answer is a sobering no. And that's why we spoke to Tyler Warren, Lead Cloud Security Engineer at USAA about the concept of data perimeters and why they must become a first-class citizen in your security strategy. Here’s a glimpse of what we spoke about: 💡 Why your data perimeter is not optional—no matter your company size or industry. 🔐 How AI security is fundamentally a data protection problem (think training set poisoning, stolen models, and more). 🛡️ Why the data perimeter is just one layer in your defense-in-depth approach—but one you cannot afford to overlook. Your data is the secret sauce to your business success. Let’s make sure it stays in your recipe. 👊 This was a great chat with Tyler and we have linked the full episode in the comments below! #cloudsecurity #dataperimeter #datasecurity

🚀 Where Do You Start in Cloud Security? 🤔 If you’re diving into cloud security, you’ve probably heard this before: “Start with a CSPM, fix all the alerts, and you’re done.” We spoke to Prahathess R. who has been a security engineer at Block, Apple, Chime and Credit Karma if that is truly the reality? 👉 It all begins with security policies and standards. Why? Without clear policies, you’re flying blind. ✈️ CSPMs will flood you with alerts, and you’ll be playing a never-ending game of whack-a-mole. 🎯 Policies and standards help you identify where the real risks lie in your infrastructure. 🔑 A solid foundation is more than just fixing misconfigurations. It’s about: 🛠 Building visibility into your environment (e.g., leveraging tools like GCP’s asset inventory). ✍️ Defining your threat model and tailoring your policies to match your risk profile. 🤝 Aligning your teams around shared goals for risk reduction. Going into 2025, if you are wondering whats a good place to start with your cloud security strategy, you will enjoy this episode with Prahathess. We have linked the full episode in the comments below! #cloudsecurity #cybersecuritypodcast #cloudsecurityprogram

🚨 From Vulnerability Management to Exposure Management: A Cloud Perspective ☁️ Cloud Security is ever changing and no doubt in 2025, it will evolve even more. For years, vulnerability management has been our go-to framework. But in the dynamic, hybrid, multi-cloud environments we work in today, is it enough to simply spot vulnerabilities? We spoke to Amit Sheps, Director of Product Marketing at IONIX about the potential shift to Exposure Management. 🔍 Visibility redefined: Why vulnerabilities alone are just one piece of the puzzle. 🌐 The cloud factor: Everything is constantly moving—so how do we keep up? 🛡️ Shifting priorities: Understanding what’s actually exposed in your cloud environment. 💡 CSPM’s role: Enriching your data for smarter, more informed decisions. If you are interested in vulnerability management of your cloud environment, you will find this episode interesting, we have linked the full episode in the comments below! #cloudsecurity #vulnerabilitymanagement #threatmanagement

🌟 Cloud Apps Are Like an Amusement Park 🎢 Forget the medieval castle with one door to guard. Your cloud environment is an open amusement park—multiple entrances, interconnected rides, and constant movement. Developers and users need seamless access, but that also means more complexity, more chaos, and more room for attack. Is there where runtime security becomes important? As we count down to 2025, a throwback to our conversation with Loris Degioanni, CTO and Founder Sysdig about runtime and kubernetes security. Runtime security tools can be like your security camera, silently observing and acting when things go wrong. Its modular plugins cover everything from eBPF to GitHub, Okta, and even multi-cloud setups. You get a complete picture of your environment—and that’s how you may win. If you are interested in runtime security, open source eBPF tools like Falco, this would be an interesting conversation for you. We have linked the full episode in the comments #cloudsecurity #runtimesecurity #cybersecuritypodcast

🚨 Rethinking the Shared Responsibility Model in Cloud Security 🚨 The shared responsibility model was simple when it was introduced a decade ago: 👉 Cloud providers manage the infrastructure. 👉 You manage configurations, data, and access. But here’s the thing: while the cloud has evolved with managed services, serverless architectures, and multi-service dependencies, that diagram has barely changed. We spoke to Kushagra Sharma about how the shared responsibility has changed! 🔑 Managed doesn’t mean safe. Even with managed services, a misstep in your configuration can still expose sensitive data. Those "managed" layers often rely on unmanaged components you may not even know about. So, where do we go from here? 💡 It's time to rethink the shared responsibility model—to build one that reflects today's cloud realities. As you plan for 2025 and thinking about your shared responsibility model, this is a good episode to listen to. We have linked the full episode in the comments below! #cloudsecurity #sharedresponsibility #cybersecuritypodcast

🎙️ What Does It Really Mean to Be a CISO? As we are counting down to 2025, we recall our conversation with Fredrick Lee, CISO Reddit, Inc. about what does it truly mean to be a CISO. Being a CISO isn’t about fighting fires in the weeds or obsessing over every technical detail. It’s about something far bigger—building a company that embraces risk wisely. 💡 🔹 Risk = Opportunity A great business doesn’t avoid risk—it strategically embraces it. Risk isn’t the enemy; it’s where innovation thrives. Think of the leap e-commerce took in the ’90s when putting your credit card on the internet seemed outrageous. Now, it’s second nature. 🔹 The Mindshift: Prevent vs. Enable As an individual contributor, your mission is to prevent risk. As a CISO? Your mission evolves—to enable the right kinds of risks that move the business forward. 🚀 🔹 Pragmatism at the Top Higher-level thinking isn’t just about “big ideas.” It’s about making calculated bets, mitigating risks where it matters, and unlocking both business and human value. From Reddit's bold stance on user communities to the foundational risks that built the internet as we know it, this episode is packed with insights that’ll leave you rethinking how security leaders drive innovation. We had a great time with Flee on the podcast and have linked the full episode for you to catch up on it, incase you haven't yet. #ciso #cybersecurityleadership #cisoinsights

What is Runtime Security in Kubernetes? 🤔 Sometimes cloud security does feel like a sea of acronyms? CSPM, CNAPP, KSPM... and now we’re talking runtime security. But what does that even mean? And why does it matter? We spoke to Shauli Rozen, CEO and Co-Founder of ARMO at Kubecon NA. 💡 Runtime is what’s actually happening in your cluster. - The system calls running in your environment. - The networking events and file access logs. - Insights from tools like eBPF, OpenTelemetry, and more. But runtime data ≠ runtime security. It’s just data until you make it actionable: ✅ Use runtime insights to fine-tune your configurations without breaking applications. ✅ Layer it over CSPM or KSPM data for better prioritization and smarter remediation. ✅ Go beyond prevention—detect and respond to real-time attacks. If runtime security in kubernetes is something you are interested in, then this episode will be valuable for you. We have linked the full episode in the comments below! #cloudsecurity #cybersecuritypodcast #kubernetessecurity