Vulnerability Management Platform

6 posts · Jun 2018 – Oct 2022

What this trail covers

Spotify's Vulnerability Management Platform (VMP), codenamed Kitsune, has been developed and implemented to efficiently and scalably reduce security risks. It automates the process of identifying, notifying asset owners, and tracking the remediation of vulnerabilities. The platform integrates with various reactive controls (RCs) and supports manual uploads, providing a centralized source of truth for vulnerabilities. It also offers metrics and visualizations on Backstage to drive engagement and

All Spotify trails

Nov 2022Spotify’s Vulnerability Management PlatformThis post details the journey of building Spotify's Vulnerability Management Platform (VMP), Kitsune. It describes the transition from a basic automation pattern using Comet to a more robust system with defined vulnerability lifecycle states, a Backstage UI plugin for visualization and prioritization, and a relational data structure for analysis. The architecture includes a 'mediator' concept to decouple RCs and handle RC-specific logic, enabling integration with multiple vulnerability sources like HackerOne and manual CSV uploads. The platform also provides metrics and insights for security teams and management.
Aug 2022How We Maintain Security Testing within the Software Development Life CycleThis post details the integration of Snyk into Spotify's CI/CD pipeline for automated security testing within the SDLC. It highlights the phased rollout, developer experience considerations (seamless integration for some languages, guided setup for others), and future plans for automated fix generation and enhanced supply chain security. The post emphasizes the use of the vulnerability management platform to track and remediate identified vulnerabilities.
Sep 2019Reflections on the Last Two Years of Spotify’s Bug Bounty ProgramThis post reflects on the first two years of Spotify's bug bounty program, detailing its evolution from manual email management to using the HackerOne platform. It highlights the program's successes, including over 365 valid reports and $120,000 in rewards. Key learnings emphasize the effectiveness of 'Golden Paths' in reducing vulnerabilities and the challenges and strategies for managing third-party developed assets through a 'Global Preferred Production Partner Program'. The post also touches on the importance of security and reliability as 'Priority 0' work and the average time to resolution for security reports.
Sep 2019Techbytes: Scalable User Privacy – Crypto Shredding at SpotifyThis post introduces 'crypto-shredding' as a technique for scalable user privacy within Spotify's data management. It explains how this method, implemented via the internal data encryption service 'Padlock,' allows for the secure and efficient deletion of user data by encrypting it with a unique key and then securely shredding that key. This approach ensures that even if the underlying data remains, it becomes inaccessible, thus respecting user privacy requests at scale.
Jun 2019Painting a Picture of Your Infrastructure in MinutesThis post details the initial development of a system for creating an up-to-date infrastructure inventory by scraping Google Cloud APIs and processing the data into a graph database (Neo4j). It highlights the use of Google Cloud Asset Inventory for data acquisition and the Cypher query language for querying the graph. The goal is to provide security responders with a quick and comprehensive view of the infrastructure during incidents.
Advertisement
Jul 2018Releasing Gimme: Managing time bound IAM conditions in Google Cloud PlatformThis post introduces Gimme, a new open-source tool that provides a web interface for creating time-bound IAM conditions in Google Cloud Platform. This capability leverages the recently announced Cloud IAM Conditions framework, allowing for temporary access grants that automatically expire. Gimme aims to improve Spotify's security posture by simplifying the management of temporary permissions for debugging and collaboration, eliminating the need for manual revocation processes.