Google on Thursday outlined a set of initiatives aimed at improving the vulnerability management ecosystem and establishing greater transparency measures around exploitation.
Security threats also stem from incomplete patches applied by vendors, with a chunk of the zero-days exploited in the wild turning out to be variants of previously patched vulnerabilities.
Mitigating such risks requires addressing the root cause of the vulnerabilities and prioritizing modern secure software development practices to eliminate entire classes of threats and block potential attack avenues.
The company further emphasized that it’s committing to publicly disclose incidents when it finds evidence of active exploitation of vulnerabilities across its product portfolio.
Lastly, the tech giant said it’s instituting a Security Research Legal Defense Fund to provide seed funding for legal representation for individuals engaging in good-faith research to find and report vulnerabilities in a manner that advances cybersecurity.
The goal, the company noted, is to escape the “doom loop” of vulnerability patching and threat mitigation by “focusing on the fundamentals of secure software development, good patch hygiene, and designing for security and ease of patching from the start.”
The disclosure comes as Google launched a free API service called deps.dev API in a bid to secure the software supply chain by providing access to security metadata and dependency information for over 50 million versions of five million open source packages found on the Go, Maven, PyPI, npm, and Cargo repositories.
In a related development, Google’s cloud division has also announced the general availability of the Assured Open Source Software (Assured OSS) service for Java and Python ecosystems.
Source: https://thehackernews.com/
