EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!
Cloud Security Podcast by Google
00:00
How to Assess the Risk of a RC Code Execution on a Google Product?
In 2014, Google security learned about the publicly disclosed through multiple vulnerability in Bash that trivially allowed RC code execution on affected systems. In parallel to taking these three steps on these three categories of assets, security team developed software to detect vulnerable systems within Google network parameters. If your company does not contain an asset that is affected by a particular vulnerability, there's no point in adding a signal for that until you actually add it. So monitor your system for port and applications can keep track of DNS registrations of URLs in large viewers. Build a thread intelligence team to study and passively monitor the activities of known and likely threads to your infrastructure.
Transcript
Play full episode
