Extending the Error Budget Model to Security and Feature Freshness
summary
Extends error‑budget mechanics to concrete measures: SLI = days since a dependency patch, SLO = a max‑age (example 30 days), policy = apply patches when approaching that age; Equifax shows a 67‑day gap between patch release and breach. A Pivotal SRE team implements a vulnerability budget, repaves boot2 VMs on a regular cadence (weekly/Tuesdays) and stays under 30 days. For features a legacy budget tracks days since feature release with a safe range and upgrades on roughly 90 days cadence.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 0:53Common Terms
- 3:06Availability and Security
- 5:35Vulnerability Budget
- 15:19Feature Freshness
related talks
27mGetting Started with SRE
30mTechniques for SLOs and Error Budgets at Scale
09mHow to answer tricky questions the SRE way
31mSite Reliability Engineering (SRE) and...
38mImplementing SRE practices: SLI/SLO deep dive
33mHow and why we lowered our SLO
30mImproving Reliability w/ Error Budgets & SRE
30mEffective security on a tight budget