Understanding Threat Modeling in Cloud
Cloud Security Podcast1 Maalis 2024

Understanding Threat Modeling in Cloud

Do you need an essential guide for Threat Modeling your Cloud Environment, then this episode is definitely for you. Ashish sat down with Tyson Garrett from TrustOnCloud. We explore why and how organizations should approach threat modeling in cloud to enhance their security posture. Tyson and Ashish go through the practical steps required for effective threat modeling, including identifying and prioritizing threats, and the continuous adaptation required to address the dynamic nature of cloud services.


Guest Socials: Tyson Garrett

Podcast Twitter - ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@CloudSecPod⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Podcast- Youtube⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security Newsletter ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

- ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cloud Security BootCamp


Questions asked:

(00:00) Introduction

(02:50) A bit about Tyson Garrett

(04:27) What is Threat Modeling in Cloud?

(06:29) Threat Modeling the right way in the Cloud

(08:23) Threat Modeling in Cloud vs On Prem

(11:05) Examples of Threat Modeling

(13:41) Threat Modeling AI Services from Cloud Providers

(21:58) Including Threat Modeling in Security Programs

(25:09) Threat Modeling Cloud at Scale

(28:08) Different Approaches for Threat Modeling

(30:21) Challenges with Threat Modeling in Cloud

(33:42) Best Practices for Threat Modeling in Cloud

(39:59) Showing ROI on Threat Modeling

(42:57) Maturity Levels of Threat Modeling

(45:21) Starting point for learning about Threat Models

(46:12) The Fun Questions

(48:41) Where can you connect with Tyson


Resources spoken about during the episode

TrustOnCloud has kindly offered a Free ThreatModel of your choice to our listeners - you can register here to pick yours

Jaksot(345)

RSA Conference 2025 Recap: Top Themes, Actionable Insights & Future Trends

RSA Conference 2025 Recap: Top Themes, Actionable Insights & Future Trends

Dive deep into the key takeaways from RSA Conference 2025 with our expert panel! Join Ashish Rajan, James Berthoty, Chris Hughes, Tanya Janca, and Francis Odum as they dissect the biggest trends, surp...

9 Touko 202553min

Mindset: Modern SOC Strategies for Cloud & Kubernetes (Ft Sergej Epp. Ex-Deutsche Bank)

Mindset: Modern SOC Strategies for Cloud & Kubernetes (Ft Sergej Epp. Ex-Deutsche Bank)

Join Ashish Rajan in this episodeas he dives deep into the evolving world of cloud security with Sergej Epp, formerly of Deutsche Bank and Palo Alto Networks, now with Sysdig.Discover why traditional ...

24 Huhti 202535min

Scaling Container Security Without Slowing Developers

Scaling Container Security Without Slowing Developers

Are you struggling to implement robust container security at scale without creating friction with your development teams? In this episode, host Ashish Rajan sits down with Cailyn Edwards, Co-Chair of ...

17 Huhti 202528min

How Attackers Stay Hidden Inside Your Azure Cloud

How Attackers Stay Hidden Inside Your Azure Cloud

In this episode, Ashish sits down with Christian Philipov, Principal Security Consultant at WithSecure, to explore the stealth tactics threat actors are using in Azure and why many of these go undetec...

10 Huhti 202535min

How Confluent Migrated Kubernetes Networking Across AWS, Azure & GCP

How Confluent Migrated Kubernetes Networking Across AWS, Azure & GCP

Ever tried solving DNS security across a multi-cloud, multi-cluster Kubernetes setup? In this episode recorded live at KubeCon, Ashish chats with Nimisha Mehta and Alvaro Aleman from Confluent's Kuber...

2 Huhti 202515min

The New Future of Cloud Security: Vendor Lock-In, Runtime, and SOC Readiness

The New Future of Cloud Security: Vendor Lock-In, Runtime, and SOC Readiness

The cloud security landscape may have just shifted — and we're here to break it down.In this special panel episode, host Ashish Rajan is joined by an all-star group of cloud and cybersecurity experts ...

26 Maalis 202551min

Detection Engineering with Google Cloud

Detection Engineering with Google Cloud

Detection rules aren’t just for fun—they’re critical for securing cloud environments. But are you using them the right way? In this episode, Ashish Rajan sits down with David French, Staff Adoption En...

20 Maalis 202542min

CNAPPs & CSPMs don’t tell the full cloud security story

CNAPPs & CSPMs don’t tell the full cloud security story

In this episode we speak to Nick Jones, an expert in offensive cloud security and Head of Research at WithSecure to expose the biggest security gaps in cloud environments and why CNAPPs and CSPMs alon...

13 Maalis 202549min