EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!

Topics covered:

• What is the scope for the vulnerability management program at Google? Does it cover OS, off-the-shelf applications, custom code we wrote … or all of the above?
• Our vulnerability prioritization includes a process called “impact assessment.” What does our impact assessment for a vulnerability look like?
• How do we prioritize what to remediate? How do we decide on the speed of remediation needed?
• How do we know if we’ve done a good job? When we look backwards, what are our critical metrics (SLIs and SLOs) and how high up the security stack is the reporting on our progress?
• What of the “Google Approach” should other companies not try to emulate? Surely some things work because of Google being Google, so what are the weird or surprising things that only work for us?