Disclosing Vulnerabilities in the Cloud with Ryan Nolette

Screaming in the Cloud

In this episode of "Screaming in the Cloud," we’re making sure things are nice and secure thanks to Ryan Nolette, Senior Security Engineer at AWS Outreach. As a part of the Outreach team, he’s responsible for making everyone understand the nuances of AWS's Vulnerability Disclosure Program. Corey and Ryan explore the intricacies of AWS's approach to security, including the emphasis on communication with researchers. You’ll also get an overview of what goes into Vulnerability Disclosure Programs and how it courts security researchers over “security researchers.” If there’s anything you can take away from this episode, it’s that Ryan takes great pride in AWS's commitment to transparency and collaboration when it comes to resolving potential security flaws.

Show Highlights

(0:00) Intro

(0:38) Blackblaze sponsor read

(1:06) The role of AWS' security team outreach group

(2:21) The nuance of the Vulnerability Disclosure Program

(4:05) Will the VDP program replace human interactions

(10:08) Response disclosure vs. coordinated disclosure

(15:26) The high-quality communication of the AWS security team

(17:33) Gitpod sponsor read

(18:45) Security researchers vs. "security researchers"

(25:54) What's next for the VDP Program?

(29:26) Avoiding "security by obscurity"

(32:08) Being intentional with security messaging

(36:16) Where you can find more from Ryan

About Ryan Nolette

Ryan is AWS's Senior Security Engineer for the Outreach Team and CoAuthor of AWS Detective. He has previously held a variety of roles including threat research, incident response consulting, and every level of security operations. With almost 2 decades in the infosec field, Ryan has been on the development and operations side of companies such as Postman, Sqrrl, Carbon Black, Crossbeam Systems, SecureWorks and Fidelity Investments. Ryan has been an active speaker and writer on threat hunting and endpoint security

Links

• AWS VDP on HackerOne: hackerone.com/aws_vdp
• AWS VDP inbox: [e-mail]
• LinkedIn: www.linkedin.com/in/cloudy-with-a-chance-of-security
• AWS Vulnerability Reporting site: https://aws.amazon.com/security/vulnerability-reporting/
• Give your feedback on the recently expanded VDP program: https://pulse.aws/survey/MOOFGRLM

Sponsors

Backblaze: https://www.backblaze.com/

Gitpod: gitpod.io