EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!

Guest:

• Ana Oprea, Staff Security Engineer, European Lead of Vulnerability Coordination Center @ Google

Topics:

• What is the scope for the vulnerability management program at Google? Does it cover OS, off-the-shelf applications, custom code we wrote … or all of the above?

• Our vulnerability prioritization includes a process called "impact assessment." What does our impact assessment for a vulnerability look like?

• How do we prioritize what to remediate? How do we decide on the speed of remediation needed?

• How do we know if we've done a good job? When we look backwards, what are our critical metrics (SLIs and SLOs) and how high up the security stack is the reporting on our progress?

• What of the "Google Approach" should other companies not try to emulate? Surely some things work because of Google being Google, so what are the weird or surprising things that only work for us?

Resources:

• SRS Book, Chapter 20: Understanding Roles and Responsibilities and Chapter 21: Building a Culture of Security and Reliability

• Why Google Stores Billions of Lines of Code in a Single Repository

• SRE book and SRE Workbook

• "How Google Secures It's Google Cloud Usage at Massive Scale" (ep107)

• "Is This Binary Legit? How Google Uses Binary Authorization and Code Provenance" (ep66)

• "How We Scale Detection and Response at Google: Automation, Metrics, Toil" (ep75)