Vulnerability Management

%%{
  init: {
    'theme': 'base',
    'themeVariables': {
      'primaryColor': '#D32F2F',
      'primaryTextColor': '#fff',
      'lineColor': '#D32F2F',
      'secondaryColor': '#FF9800',
      'tertiaryColor': '#4CAF50'
    }
  }
}%%
flowchart TD
    START["🔍 Vulnerability Detected"] --> SOURCE{"📊 Detection Source?"}
    
    SOURCE -->|Dependabot| DEPEND["📦 Dependency Vulnerability"]
    SOURCE -->|CodeQL| CODE["💻 Code Vulnerability"]
    SOURCE -->|OWASP| OWASP["🔍 Dependency Check Finding"]
    SOURCE -->|Security Advisory| ADVISORY["🚨 GitHub Advisory"]
    
    DEPEND --> CVSS{"🎯 CVSS Score?"}
    CODE --> CVSS
    OWASP --> CVSS
    ADVISORY --> CVSS
    
    CVSS -->|9.0-10.0| CRITICAL["🔴 Critical<br/>SLA: 7 days"]
    CVSS -->|7.0-8.9| HIGH["🟠 High<br/>SLA: 30 days"]
    CVSS -->|4.0-6.9| MEDIUM["🟡 Medium<br/>SLA: 90 days"]
    CVSS -->|0.1-3.9| LOW["🟢 Low<br/>SLA: 180 days"]
    
    CRITICAL --> EXPLOIT{"🎯 Exploited in Wild?"}
    HIGH --> IMPACT{"💼 Business Impact?"}
    MEDIUM --> CONTEXT{"🔍 Contextual Risk?"}
    LOW --> SCHEDULE["📅 Schedule Remediation"]
    
    EXPLOIT -->|YES| IMMEDIATE["⚡ Immediate Action<br/>4 hours target"]
    EXPLOIT -->|NO| VERIFY["✅ Verify Exploitability"]
    
    IMPACT -->|Significant| PRIORITY["🔴 High Priority"]
    IMPACT -->|Limited| STANDARD["🟡 Standard Priority"]
    
    CONTEXT -->|Reachable| ASSESS["🔍 Risk Assessment"]
    CONTEXT -->|Unreachable| BACKLOG["📋 Backlog"]
    
    IMMEDIATE --> REMEDIATE["🔧 Apply Remediation"]
    VERIFY --> REMEDIATE
    PRIORITY --> REMEDIATE
    STANDARD --> REMEDIATE
    ASSESS --> REMEDIATE
    SCHEDULE --> REMEDIATE
    BACKLOG --> MONITOR["👁️ Monitor for Changes"]
    
    REMEDIATE --> TEST["🧪 Test & Validate"]
    TEST --> DOCUMENT["📝 Document Resolution"]
    DOCUMENT --> CLOSE["✅ Close Vulnerability"]
    
    style START fill:#2196F3,color:#fff
    style CRITICAL fill:#D32F2F,color:#fff
    style HIGH fill:#FF9800,color:#fff
    style MEDIUM fill:#FFC107,color:#000
    style LOW fill:#4CAF50,color:#fff
    style IMMEDIATE fill:#D32F2F,color:#fff
    style REMEDIATE fill:#1565C0,color:#fff
    style CLOSE fill:#4CAF50,color:#fff

Attack_Vector (AV):
  - Network (N): Remotely exploitable = Higher severity
  - Adjacent (A): Local network required = Medium severity
  - Local (L): Local access required = Lower severity
  - Physical (P): Physical access required = Lowest severity

Attack_Complexity (AC):
  - Low (L): Easy to exploit = Higher severity
  - High (H): Difficult to exploit = Lower severity

Privileges_Required (PR):
  - None (N): No authentication = Highest severity
  - Low (L): Basic user privileges = Medium severity
  - High (H): Admin privileges = Lower severity

User_Interaction (UI):
  - None (N): No user action required = Higher severity
  - Required (R): User must take action = Lower severity

Scope (S):
  - Changed (C): Impacts beyond vulnerable component = Higher severity
  - Unchanged (U): Impact limited to component = Lower severity

Confidentiality_Impact (C):
  - High (H): Total information disclosure = Highest severity
  - Low (L): Limited disclosure = Medium severity
  - None (N): No confidentiality impact = Lowest severity

Integrity_Impact (I):
  - High (H): Complete data modification = Highest severity
  - Low (L): Limited modification = Medium severity
  - None (N): No integrity impact = Lowest severity

Availability_Impact (A):
  - High (H): Complete system unavailability = Highest severity
  - Low (L): Reduced performance = Medium severity
  - None (N): No availability impact = Lowest severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score: 10.0 (Critical)
Interpretation: Remotely exploitable, easy to exploit, no authentication,
               scope change, high impact to confidentiality/integrity/availability

GitHub_Dependabot:
  - Frequency: Real-time alerts
  - Coverage: npm, Maven, pip, Docker, GitHub Actions
  - Action: Auto-creates PR with fix
  - Integration: .github/dependabot.yml

GitHub_CodeQL:
  - Frequency: On push, PR, scheduled scan
  - Coverage: Java, JavaScript, Python code vulnerabilities
  - Action: Creates security alert
  - Integration: .github/workflows/codeql.yml

OWASP_Dependency_Check:
  - Frequency: Daily via CI/CD
  - Coverage: All Maven dependencies
  - Action: Fails build if critical found
  - Integration: pom.xml plugin configuration

GitHub_Security_Advisories:
  - Frequency: Real-time notifications
  - Coverage: All dependencies and platforms
  - Action: Email + dashboard alert
  - Integration: Repository settings

SonarCloud:
  - Frequency: On push, PR
  - Coverage: Code quality + security hotspots
  - Action: Quality gate failure
  - Integration: .github/workflows/verify-release.yml

flowchart LR
    VULN["🔍 Vulnerability"] --> CVSS["📊 CVSS Score"]
    VULN --> EXPLOIT["💣 Exploitability"]
    VULN --> ATTACK["🎯 Attack Surface"]
    VULN --> DATA["🔐 Data Exposure"]
    
    CVSS --> RISK["⚖️ Risk Score"]
    EXPLOIT --> RISK
    ATTACK --> RISK
    DATA --> RISK
    
    RISK --> CRITICAL{"🔴 Critical Risk?"}
    RISK --> HIGH{"🟠 High Risk?"}
    RISK --> MEDIUM{"🟡 Medium Risk?"}
    RISK --> LOW{"🟢 Low Risk?"}
    
    CRITICAL --> IMMEDIATE["⚡ Immediate Action"]
    HIGH --> URGENT["🔴 Urgent Action"]
    MEDIUM --> SCHEDULED["📅 Scheduled Action"]
    LOW --> BACKLOG["📋 Backlog"]
    
    style VULN fill:#2196F3,color:#fff
    style RISK fill:#FF9800,color:#fff
    style CRITICAL fill:#D32F2F,color:#fff
    style IMMEDIATE fill:#D32F2F,color:#fff

Patch_Update:
  - Action: Apply vendor security patch
  - Priority: Preferred solution
  - Risk: Low (tested by vendor)
  - Example: "Update Spring Boot 2.7.5 → 2.7.18"

Version_Upgrade:
  - Action: Upgrade to non-vulnerable version
  - Priority: Standard approach
  - Risk: Medium (breaking changes possible)
  - Example: "Upgrade Vaadin 14.x → 23.x"

Configuration_Change:
  - Action: Disable vulnerable feature
  - Priority: Quick mitigation
  - Risk: Low (functionality may be reduced)
  - Example: "Disable XML external entity processing"

Virtual_Patch:
  - Action: WAF rule or network control
  - Priority: Temporary mitigation
  - Risk: Medium (bypass possible)
  - Example: "Block exploit pattern in AWS WAF"

Replace_Component:
  - Action: Switch to alternative library
  - Priority: Last resort
  - Risk: High (significant refactoring)
  - Example: "Replace Log4j with Logback"

Accept_Risk:
  - Action: Document risk acceptance
  - Priority: Only with CEO approval
  - Risk: Varies (requires monitoring)
  - Example: "Low CVSS + unreachable code + no fix available"

# 1. Create remediation branch
git checkout -b security/CVE-2024-XXXXX-remediation
git pull origin main

# 2. Apply fix (example: dependency update)
# Edit pom.xml or use Maven versions plugin
mvn versions:use-latest-versions -Dincludes=org.springframework:spring-core

# 3. Build and test
mvn clean install
mvn test
mvn verify

# 4. Security validation
mvn dependency-check:check
# Review report: target/dependency-check-report.html

# 5. Commit with security context
git add pom.xml
git commit -m "security: fix CVE-2024-XXXXX in Spring Core

- Update Spring Core 5.3.20 → 5.3.30
- CVSS Score: 9.8 (Critical)
- Vulnerability: Remote Code Execution
- Fixes: https://github.com/advisories/GHSA-xxxx-xxxx-xxxx
- Tested: All unit tests pass, security scan clean

Refs: #1234"

# 6. Push and create PR
git push origin security/CVE-2024-XXXXX-remediation
gh pr create --title "Security: Fix CVE-2024-XXXXX" \
  --body "Fixes critical vulnerability in Spring Core" \
  --label "security,priority:critical"

## Security Fix Verification

- [ ] **Vulnerability Resolved:** Confirmed by security scanner
- [ ] **No New Vulnerabilities:** Dependency check clean
- [ ] **Unit Tests Pass:** `mvn test` successful
- [ ] **Integration Tests Pass:** `mvn verify` successful
- [ ] **Security Tests Pass:** CodeQL analysis clean
- [ ] **Performance Impact:** No degradation observed
- [ ] **Compatibility Check:** No breaking changes introduced
- [ ] **Documentation Updated:** CHANGELOG.md updated
- [ ] **Security Advisory Reviewed:** GitHub advisory closed

**Evidence:**
- Dependency Check Report: target/dependency-check-report.html
- CodeQL Scan: Clean (0 alerts)
- Test Coverage: 82% (maintained)
- Build Status: ✅ Success

# .github/workflows/security-verification.yml
name: Security Verification

on:
  pull_request:
    branches: [ main ]
    labels: [ security ]

jobs:
  verify-security-fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      
      - name: Set up JDK 21
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
        with:
          java-version: '21'
          distribution: 'temurin'
      
      - name: Run OWASP Dependency Check
        run: mvn dependency-check:check -P dependency-check
      
      - name: Check for vulnerabilities
        run: |
          if grep -q "Critical" target/dependency-check-report.html; then
            echo "❌ Critical vulnerabilities still present"
            exit 1
          fi
          echo "✅ No critical vulnerabilities detected"
      
      - name: Run security tests
        run: mvn test -Dsecurity.test=true
      
      - name: Upload verification report
        uses: actions/upload-artifact@ea165860e890e4c0d99e2a7e241d52ce9fdf0b90 # v4.5.0
        with:
          name: security-verification-report
          path: target/dependency-check-report.html

# Vulnerability CVE-2024-XXXXX - Closure Report

## Summary
- **Vulnerability ID:** CVE-2024-XXXXX
- **Severity:** Critical (CVSS 9.8)
- **Component:** Spring Core 5.3.20
- **Detected:** 2024-01-15
- **Resolved:** 2024-01-16
- **SLA:** 7 days (Met: 1 day)

## Resolution
- **Action:** Version upgrade
- **Fix:** Spring Core 5.3.20 → 5.3.30
- **PR:** #1234
- **Deployment:** 2024-01-16 14:30 UTC

## Verification
- ✅ OWASP Dependency Check: Clean
- ✅ CodeQL Scan: No alerts
- ✅ Unit Tests: 100% pass
- ✅ Integration Tests: 100% pass
- ✅ Security Regression Tests: Pass

## Lessons Learned
- **Detection:** Dependabot alert received within 2 hours
- **Triage:** Severity confirmed in 30 minutes
- **Fix:** Patch applied in 4 hours
- **Deployment:** Production rollout in 24 hours
- **Improvement:** Consider auto-merge for patch-level security updates

## References
- GitHub Advisory: https://github.com/advisories/GHSA-xxxx-xxxx-xxxx
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-XXXXX
- Spring Security Advisory: https://spring.io/security/cve-2024-xxxxx

# .github/workflows/vulnerability-sla-monitoring.yml
name: Vulnerability SLA Monitoring

on:
  schedule:
    - cron: '0 9 * * *' # Daily at 9 AM UTC
  workflow_dispatch:

jobs:
  check-sla:
    runs-on: ubuntu-latest
    steps:
      - name: Check Dependabot Alerts
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const { data: alerts } = await github.rest.dependabot.listAlertsForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open'
            });
            
            const now = new Date();
            const criticalSLA = 7 * 24 * 60 * 60 * 1000; // 7 days
            const highSLA = 30 * 24 * 60 * 60 * 1000; // 30 days
            
            let breaches = [];
            
            for (const alert of alerts) {
              const createdAt = new Date(alert.created_at);
              const age = now - createdAt;
              const severity = alert.security_advisory.severity;
              
              if (severity === 'critical' && age > criticalSLA) {
                breaches.push(`CRITICAL SLA BREACH: ${alert.security_advisory.cve_id}`);
              } else if (severity === 'high' && age > highSLA) {
                breaches.push(`HIGH SLA BREACH: ${alert.security_advisory.cve_id}`);
              }
            }
            
            if (breaches.length > 0) {
              core.setFailed(`SLA Breaches Detected:\n${breaches.join('\n')}`);
              // Trigger notification (Slack, email, etc.)
            }

# SLA Escalation Notice

**To:** CEO / Security Team Lead
**From:** Automated SLA Monitor
**Date:** 2024-01-15
**Priority:** 🔴 URGENT

## SLA Breach Alert

**Vulnerability:** CVE-2024-XXXXX
**Severity:** Critical (CVSS 9.8)
**Component:** Spring Core 5.3.20
**Age:** 6 days (86% of 7-day SLA)
**Status:** In Progress

## Current Status
- PR #1234 created for remediation
- Blocked on: Integration test failures
- Estimated Resolution: 2024-01-16

## Required Action
- [ ] CEO acknowledgment
- [ ] Risk acceptance or remediation prioritization
- [ ] Resource allocation if needed

## Impact Assessment
- **Exploitability:** High (POC available)
- **Attack Surface:** Internet-facing API
- **Data at Risk:** Customer PII
- **Business Impact:** €15K/day potential loss

## Escalation History
- Day 3: Development team notified
- Day 5: Team lead engaged
- Day 6: CEO escalation (this notice)