Security Industry Call-to-Action: We Need a Cloud Vulnerability Database
summary
Argues that the shared-responsibility model fails to scale for cloud complexity and inconsistent vendor/provider misconfiguration tracking, and calls for extending the CVE model into a cloud-focused vulnerability database. Names cloud misconfigurations as the problem and discusses using an expanded CVE-style repository (with the Cloud Security Alliance coordinating efforts) as the proposed approach.
AI-written summary · about
chapters (6)
- 0:00Start
- 11:13Vulnerable Configuration Users own the remediation
- 13:31Example #2: Cloud middleware
- 16:42Example #3: Key Leak The issue
- 18:23Summary The Shared Responsibility Model is broken
- 29:44What is Needed
related talks
09mCloud Security and how to leverage the shared responsibility model to your advantage
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...
32mA Vulnerability Database Should Not Be About Vulnerabilities!
11mVulnerability Supply Chains
58mCloud Attack Surface Management
45mProtecting you from you: Misconfiguration-caused breaches