4 ms·
https://careers.google.com/jobs#!t=jo&jid=/google/security-engineering-manager-detection-google-building-c-747-6th-st-s-kirkland-3537510028 https://careers.goog
by kyrra 9y ago
https://careers.google.com/jobs#!t=jo&jid=/google/security-engineering-manager-detection-google-building-c-747-6th-st-s-kirkland-3537510028 https://careers.google.com/jobs#!t=jo&jid=/google/security-e...
The job even lists insider threat as part of their responsibility.
- kerng 9y agoYeah, still not the same as actually performing breaches themselves to see how long it takes to compromise, and if they get detected and how long it takes to remediate and evict the adversary. I should have been a bit clearer with what I meant initially.
- sulam 9y agoHow do you know there isn’t a team at Google doing this? It’s standard practice at companies of even middling size and Google is so large your friend might just be unaware of it.
- kerng 9y agoA Google security manager told me at a conference when chatting about this in 2016. They were thinking of staffing a breach team, but did not have one then.
- mehrdadn 9y agoI thought Project Zero tries to find vulnerabilities in Google stuff too?
- kerng 9y agoProject Zero is different compared to performing end to end breaches. A breach team might use 0-days of Project Zero to actually compromise Google's internal assets to see if their defenders can detect an adversary. FB has such a team and they gave public presentations (one was at RuxCon 2016) how they compromise for instance their domain controllers and stuff.