Preview Mode Links will not work in preview mode

Cloud Security Podcast by Google

Feb 20, 2023


  • Ana Oprea, Staff Security Engineer, European Lead of Vulnerability Coordination Center @ Google


  • What is the scope for the vulnerability management program at Google? Does it cover  OS, off-the-shelf applications, custom code we wrote … or all of the above?

  • Our vulnerability prioritization includes a process called “impact assessment.” What does our impact assessment for a vulnerability look like?

  • How do we prioritize what to remediate? How do we decide on the speed of remediation needed?

  • How do we know if we’ve done a good job? When we look backwards, what are our critical metrics (SLIs and SLOs) and how high up the security stack is the reporting on our progress?

  • What of the “Google Approach” should other companies not try to emulate? Surely some things work because of Google being Google, so what are the weird or surprising things that only work for us?