Thursday, November 14, 2024
HomeCloudGoogle to Issue CVEs for Critical Cloud Vulnerabilities

Google to Issue CVEs for Critical Cloud Vulnerabilities

Published on

Malware protection

Google Cloud has announced a significant step forward in its commitment to transparency and security by stating it will begin issuing Common Vulnerabilities and Exposures (CVEs) for critical vulnerabilities found in its cloud services.

This move, which underscores Google’s dedication to helping enterprises and government agencies protect against potential security threats, is set to enhance visibility and trust in Google Cloud’s security practices, even when no direct customer action is required.

In a statement released today, Google Cloud confirmed that it will now assign CVEs to critical vulnerabilities in its Google Cloud services, even in cases where no immediate patching or customer intervention is necessary.

- Advertisement - SIEM as a Service

This decision is aimed at bolstering awareness and fostering transparency across the ecosystem.

To distinguish these vulnerabilities and avoid unnecessary concern, the company will tag such CVEs with the label “exclusively-hosted-service,” indicating that no action is required from customers.

“Transparency and shared action, to learn from and mitigate whole classes of vulnerability, is a vital part of countering bad actors. We will continue to lead and innovate across the community of defenders,” said Phil Venables, Chief Information Security Officer (CISO) of Google Cloud.

Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)

Commitment to Transparency and Security

Google’s announcement aligns with findings from the Cyber Safety Review Board (CSRB), which has highlighted the importance of strong security practices to prevent breaches and system compromises.

The CSRB’s recent report on Storm-0558, an advanced persistent threat (APT) group that exploited vulnerabilities to access email accounts of several organizations, including government agencies, demonstrated the critical need for transparency and accountability among cloud service providers.

Google Cloud’s decision to issue CVEs is seen as a proactive measure to address these concerns and promote security best practices.

Google Cloud’s latest move builds on its 20-year history of collaboration with external security researchers.

Since launching its first CVE Numbering Authority (CNA) in 2011, Google has issued more than 8,000 CVEs for its consumer and enterprise products.

Its partnership with MITRE, the organization managing the CVE system, expanded in 2022 when Google became one of MITRE’s four Top-Level Roots, further cementing its leadership in the field of vulnerability reporting.

Through initiatives such as the Cloud Vulnerability Reward Program (VRP), Google has fostered a culture of collaboration between its engineers and external security researchers.

Now, by issuing CVEs for its cloud vulnerabilities, Google continues to lead the way in advancing security practices across the entire cloud services ecosystem.

Today’s announcement is part of Google Cloud’s broader “shared fate” model, where the company works closely with customers to improve security continuously.

By making critical vulnerabilities publicly trackable via CVEs, Google Cloud aims to empower its customers, partners, and the security community to better assess and address potential risks.

Analyze Unlimited Phishing & Malware with ANY.RUN For Free - 14 Days Free Trial.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Google Unveils New Intelligent, Real-Time Protections for Android Users

Google has once again raised the bar for mobile security by introducing two new...

Chinese National Faces 20 Years of Jail Time for Laundering Millions in Crypto

Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and...

GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster

GitLab has rolled out critical security updates to address multiple vulnerabilities in its Community...

Windows 0-Day Exploited in Wild with Single Right Click

A newly discovered zero-day vulnerability, CVE-2024-43451, has been actively exploited in the wild, targeting Windows...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Unveils New Intelligent, Real-Time Protections for Android Users

Google has once again raised the bar for mobile security by introducing two new...

Chinese National Faces 20 Years of Jail Time for Laundering Millions in Crypto

Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and...

GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster

GitLab has rolled out critical security updates to address multiple vulnerabilities in its Community...