Share
Thanks for visiting The Cell Phone Junkie! I will be taking the time each week to discuss my favorite topic, cell phones. Any feedback is appreciated and welcome. You can email me at: questions (AT) thecellphonejunkie (DOT) com or call: 206-203-3734 Thanks and welcome!
…
continue reading
Manage episode 478232015 series 2892548
Content provided by Anton Chuvakin. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Anton Chuvakin or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.
Guests:
- Michael Cote, Cloud VRP Lead, Google Cloud
- Aadarsh Karumathil, Security Engineer, Google Cloud
Topics:
- Vulnerability response at cloud-scale sounds very hard! How do you triage vulnerability reports and make sure we're addressing the right ones in the underlying cloud infrastructure?
- How do you determine how much to pay for each vulnerability? What is the largest reward we paid? What was it for?
- What products get the most submissions? Is this driven by the actual product security or by trends and fashions like AI?
- What are the most likely rejection reasons?
- What makes for a very good - and exceptional? - vulnerability report? We hear we pay more for "exceptional" reports, what does it mean?
- In college Tim had a roommate who would take us out drinking on his Google web app vulnerability rewards. Do we have something similar for people reporting vulnerabilities in our cloud infrastructure? Are people making real money off this?
- How do we actually uniquely identify vulnerabilities in the cloud? CVE does not work well, right?
- What are the expected risk reduction benefits from Cloud VRP?
Resources:
256 episodes
))
