- Microsoft Outage Discussion Meeting
Quick recap. The meeting was an open session of Cloud Security Office Hours. Shawn and Brian started with a casual conversation about car batteries, travel, and remote work challenges. They discussed the recent Microsoft outage, noting the lack of clear communication and the impact on email and Teams. The group talked about the need for more guest speakers and the value of short presentations for professional development. They discussed the SSVC framework for vulnerability management and how it differs from CVSS. Tyler proposed a project called isthisfine.com to help non-technical users understand if CVEs apply to them. The group also touched on AI-driven security tools and the risks of "vibe coding."
Microsoft Outage Discussion Meeting
The meeting focused on discussing Microsoft's recent outage that affected email and other services for over a day and a half. Participants shared their experiences and observations about the poor communication from Microsoft during the incident, with many expressing concern about the lack of clear information about the root cause. The group also discussed bringing more guest speakers to future Cloud Security Office Hours sessions, with suggestions to present 15-minute technical talks on various topics from the website's extensive content. Shawn announced that the CSOH website remained operational during the Microsoft outage due to its deployment across three cloud providers (Azure, GCP, and AWS).
Cloud Deployment Management Strategy
Shawn explained how CSOH manages multiple cloud deployments using GitHub Actions to create static HTML copies that are served through different cloud providers including GCP, AWS, and Azure, with content distributed through Cloudflare. He shared that the project operates on a personal budget of several thousand dollars per year, covering costs for hosting, domains, mailing lists, and other expenses. The discussion concluded with personal updates, including Shawn's son receiving a full-ride scholarship for construction management and conversations about supply chain management education and semiconductor manufacturing in Arizona.
Apache Vulnerability Priority Framework Discussion
The group discussed a recent Apache vulnerability (CVE-2026-119618) that received less media attention compared to other security issues like HTTP to shell. Neil explained CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) framework, which uses a decision tree based on exposure to internet, known exploitation, automatability, and impact level to prioritize patching. The discussion highlighted the challenge of distinguishing between legitimate security concerns and sensationalized threats, with Neil noting that while AI-powered vulnerability discovery has increased CVE numbers, many reported issues lack real-world impact.
Security Severity Vulnerability Classification Methodology
The group discussed the Security Severity Vulnerability Classification (SSVC) methodology as an alternative to CVSS scoring for vulnerability management. Neil explained that SSVC was developed by Carnegie Mellon with CISA and provides a flexible decision tree that focuses on actual risk rather than fixed severity levels. Umang shared a real-world example of how his team implemented SSVC through their tools (Qualys and Wiz), which significantly reduced the number of identified vulnerabilities from about 1,000 to a more manageable number when using CISA CAV. The discussion also touched on how SSVC could be explained to auditors, with Neil noting that while auditors ultimately make decisions, organizations can provide explanations and reasoning for using alternative methodologies.
AI Security Tools Implementation Discussion
The group discussed the implementation and impact of AI-powered security tools, particularly in the context of recent security incidents attributed to tools like ARTEX. Neil expressed skepticism that these tools significantly change existing defense strategies, noting that they primarily automate existing attack methods rather than introduce fundamentally new vulnerabilities. The discussion highlighted concerns about organizations becoming more vulnerable due to poor security practices and the potential for third-party dependencies to introduce risks, with examples like the recent Humble Bundle security incident where a code update dismantled their previous security measures.
Security Tools and Vulnerability Service
The group discussed new security tools that can automatically generate data flow diagrams and system architecture diagrams from code repositories. Neil demonstrated a tool that analyzes code to identify security issues and generate requirements, while Tyler proposed creating a service called isthisfine.com to help non-technical users determine if their systems are affected by security vulnerabilities in an accessible way. The team agreed to collaborate on developing Tyler's idea as a CSOH side project, with plans to create a Google Doc to outline requirements and features for the service.