Guest:

• Maddie Stone, Security Researcher @ Google

Topics:

• How do we judge the real risk of being attacked using an exploit for a zero day vulnerability? Does the zero day risk vary by company, industry, etc?
• What does pricing for zero days tell us, if anything? Are prices more driven by supply or demand these days?
• What security controls or defenses are useful against zero days including against chained zero days?
• Where are the cloud zero days? We get lots of attention on iOS and Android, what about the cloud platforms?
• So, how do we solve the paradox of zero days, are they more scary than risky or more risky than scary? Or both?

Resources:

• Project Zero blog
• A walk through Project Zero metrics
• Threat Analysis Group (TAG) blog