Переходьте в офлайн за допомогою програми Player FM !
EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!
Manage episode 355884846 series 2892548
Guest:
Ana Oprea, Staff Security Engineer, European Lead of Vulnerability Coordination Center @ Google
Topics:
What is the scope for the vulnerability management program at Google? Does it cover OS, off-the-shelf applications, custom code we wrote … or all of the above?
Our vulnerability prioritization includes a process called “impact assessment.” What does our impact assessment for a vulnerability look like?
How do we prioritize what to remediate? How do we decide on the speed of remediation needed?
How do we know if we’ve done a good job? When we look backwards, what are our critical metrics (SLIs and SLOs) and how high up the security stack is the reporting on our progress?
What of the “Google Approach” should other companies not try to emulate? Surely some things work because of Google being Google, so what are the weird or surprising things that only work for us?
Resources:
SRS Book, Chapter 20: Understanding Roles and Responsibilities and Chapter 21: Building a Culture of Security and Reliability
Why Google Stores Billions of Lines of Code in a Single Repository
SRE book and SRE Workbook
“How Google Secures It's Google Cloud Usage at Massive Scale” (ep107)
“Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance” (ep66)
“How We Scale Detection and Response at Google: Automation, Metrics, Toil” (ep75)
170 епізодів
Manage episode 355884846 series 2892548
Guest:
Ana Oprea, Staff Security Engineer, European Lead of Vulnerability Coordination Center @ Google
Topics:
What is the scope for the vulnerability management program at Google? Does it cover OS, off-the-shelf applications, custom code we wrote … or all of the above?
Our vulnerability prioritization includes a process called “impact assessment.” What does our impact assessment for a vulnerability look like?
How do we prioritize what to remediate? How do we decide on the speed of remediation needed?
How do we know if we’ve done a good job? When we look backwards, what are our critical metrics (SLIs and SLOs) and how high up the security stack is the reporting on our progress?
What of the “Google Approach” should other companies not try to emulate? Surely some things work because of Google being Google, so what are the weird or surprising things that only work for us?
Resources:
SRS Book, Chapter 20: Understanding Roles and Responsibilities and Chapter 21: Building a Culture of Security and Reliability
Why Google Stores Billions of Lines of Code in a Single Repository
SRE book and SRE Workbook
“How Google Secures It's Google Cloud Usage at Massive Scale” (ep107)
“Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance” (ep66)
“How We Scale Detection and Response at Google: Automation, Metrics, Toil” (ep75)
170 епізодів
Усі епізоди
×Ласкаво просимо до Player FM!
Player FM сканує Інтернет для отримання високоякісних подкастів, щоб ви могли насолоджуватися ними зараз. Це найкращий додаток для подкастів, який працює на Android, iPhone і веб-сторінці. Реєстрація для синхронізації підписок між пристроями.