security-vulnerability

name	security-vulnerability
description	نظام إدارة واكتشاف ومعالجة الثغرات الأمنية. استخدم هذا الـ skill عند: فحص الثغرات، إدارة نقاط الضعف، اختبار الاختراق، تقييم المخاطر الأمنية، OWASP compliance، إدارة الأحداث الأمنية (SIEM)، استجابة الحوادث، تحديثات أمنية، مسح الشبكة، أو أي مهمة تتعلق بالأمن السيبراني. يتوافق مع إطار عمل الهيئة الوطنية للأمن السيبراني (NCA-ECC).

Security Vulnerability Management

إدارة الثغرات الأمنية

Architecture

┌──────────────────────────────────────────────────────────┐
│                  Security Operations Center               │
│                                                          │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌─────────┐ │
│  │ Vuln     │  │ SAST     │  │ DAST     │  │ Depend  │ │
│  │ Scanner  │  │ Code     │  │ Runtime  │  │ Check   │ │
│  │ (Infra)  │  │ Analysis │  │ Scan     │  │ (SCA)   │ │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬────┘ │
│       └──────────────┼──────────────┼─────────────┘      │
│                      ▼                                    │
│              ┌──────────────┐                             │
│              │  Aggregator  │                             │
│              │  & Dedup     │                             │
│              └──────┬───────┘                             │
│                     ▼                                     │
│              ┌──────────────┐      ┌──────────────┐      │
│              │ Risk Scoring │─────►│ Alert Engine │      │
│              │ & Prioritize │      │ & Workflow   │      │
│              └──────────────┘      └──────────────┘      │
└──────────────────────────────────────────────────────────┘

Domain Model

// === الثغرة الأمنية ===
public class Vulnerability : BaseAuditableEntity
{
    public int Id { get; set; }
    public string VulnId { get; set; } = string.Empty;          // VULN-2024-00001
    public string Title { get; set; } = string.Empty;
    public string Description { get; set; } = string.Empty;
    
    // Classification
    public VulnerabilityType Type { get; set; }
    public VulnerabilityCategory Category { get; set; }
    public string? CveId { get; set; }                           // CVE-2024-XXXXX
    public string? CweId { get; set; }                           // CWE-79 (XSS)
    public string? OwaspCategory { get; set; }                   // A01:2021
    
    // Severity (CVSS v3.1)
    public decimal CvssScore { get; set; }                       // 0.0 - 10.0
    public CvssSeverity Severity { get; set; }
    public string? CvssVector { get; set; }                      // CVSS:3.1/AV:N/AC:L/...
    
    // Risk Assessment
    public ExploitabilityLevel Exploitability { get; set; }
    public bool IsExploitedInWild { get; set; }
    public bool HasPublicExploit { get; set; }
    public BusinessImpact BusinessImpact { get; set; }
    public int RiskScore { get; set; }                           // Custom: CVSS × Impact
    
    // Affected Asset
    public int AssetId { get; set; }
    public string AssetName { get; set; } = string.Empty;
    public AssetType AssetType { get; set; }
    public string? AffectedComponent { get; set; }
    public string? AffectedVersion { get; set; }
    
    // Discovery
    public DiscoverySource Source { get; set; }
    public DateTime DiscoveredAt { get; set; }
    public int? DiscoveredByUserId { get; set; }
    public string? ScanToolName { get; set; }
    
    // Remediation
    public VulnStatus Status { get; set; }
    public string? RemediationPlan { get; set; }
    public string? Workaround { get; set; }
    public int? AssignedToId { get; set; }
    public DateTime? RemediationDueDate { get; set; }
    public DateTime? RemediatedAt { get; set; }
    public DateTime? VerifiedAt { get; set; }
    public int? VerifiedByUserId { get; set; }
    
    // SLA tracking
    public int SlaHours { get; set; }                            // Based on severity
    public bool IsSlaBreached { get; set; }
    
    public List<VulnerabilityNote> Notes { get; set; } = new();
    public List<VulnerabilityAttachment> Attachments { get; set; } = new();
}

public enum CvssSeverity
{
    None,           // 0.0
    Low,            // 0.1-3.9
    Medium,         // 4.0-6.9
    High,           // 7.0-8.9
    Critical        // 9.0-10.0
}

public enum VulnerabilityType
{
    Infrastructure,     // بنية تحتية
    Application,        // تطبيقات
    Configuration,      // إعدادات
    CodeLevel,          // مستوى الكود
    Dependency,         // مكتبات خارجية
    Network,            // شبكة
    CloudMisconfig,     // إعدادات سحابية
    Authentication,     // مصادقة
    Encryption          // تشفير
}

public enum VulnerabilityCategory
{
    // OWASP Top 10 (2021)
    BrokenAccessControl,        // A01 - كسر التحكم بالوصول
    CryptographicFailures,      // A02 - فشل التشفير
    Injection,                  // A03 - حقن
    InsecureDesign,             // A04 - تصميم غير آمن
    SecurityMisconfiguration,   // A05 - إعدادات أمنية خاطئة
    VulnerableComponents,       // A06 - مكونات ضعيفة
    AuthenticationFailures,     // A07 - فشل المصادقة
    IntegrityFailures,          // A08 - فشل سلامة البيانات
    LoggingFailures,            // A09 - فشل التسجيل والمراقبة
    SSRF,                       // A10 - تزوير الطلبات
    Other
}

public enum DiscoverySource
{
    AutomatedScan,          // فحص تلقائي
    PenetrationTest,        // اختبار اختراق
    BugBounty,              // مكافآت الثغرات
    CodeReview,             // مراجعة الكود
    IncidentResponse,       // استجابة لحادث
    VendorAdvisory,         // تنبيه من المورد
    ThreatIntelligence,     // استخبارات تهديد
    InternalAudit,          // تدقيق داخلي
    UserReport              // بلاغ مستخدم
}

// === الحادث الأمني ===
public class SecurityIncident : BaseAuditableEntity
{
    public int Id { get; set; }
    public string IncidentNumber { get; set; } = string.Empty;
    public string Title { get; set; } = string.Empty;
    public string Description { get; set; } = string.Empty;
    public IncidentSeverity Severity { get; set; }
    public IncidentType Type { get; set; }
    public IncidentStatus Status { get; set; }
    
    // Impact
    public string? AffectedSystems { get; set; }
    public int? AffectedUsersCount { get; set; }
    public bool DataBreached { get; set; }
    public string? DataBreachDetails { get; set; }
    
    // Timeline
    public DateTime DetectedAt { get; set; }
    public DateTime? ContainedAt { get; set; }
    public DateTime? EradicatedAt { get; set; }
    public DateTime? RecoveredAt { get; set; }
    public DateTime? LessonsLearnedAt { get; set; }
    
    // Assignment
    public int? IncidentCommanderId { get; set; }
    public List<int> ResponseTeamIds { get; set; } = new();
    
    public List<IncidentTimeline> Timeline { get; set; } = new();
    public List<int> RelatedVulnerabilityIds { get; set; } = new();
}

public enum IncidentType
{
    Malware,                // برمجيات خبيثة
    Phishing,               // تصيد احتيالي
    Ransomware,             // فدية
    DataBreach,             // تسريب بيانات
    DDoS,                   // حجب خدمة
    UnauthorizedAccess,     // وصول غير مصرح
    InsiderThreat,          // تهديد داخلي
    AccountCompromise,      // اختراق حساب
    WebDefacement,          // تشويه موقع
    DataLoss                // فقدان بيانات
}

// === أصل أمني ===
public class SecurityAsset
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
    public SecurityAssetType Type { get; set; }
    public string? IpAddress { get; set; }
    public string? Hostname { get; set; }
    public string? OperatingSystem { get; set; }
    public string? Version { get; set; }
    public CriticalityLevel Criticality { get; set; }
    public int DepartmentId { get; set; }
    public DateTime? LastScanDate { get; set; }
    public int OpenVulnerabilities { get; set; }
}

Vulnerability Scanner Integration

public interface IVulnerabilityScanner
{
    Task<ScanResult> ScanAsync(ScanRequest request);
    Task<List<Vulnerability>> ParseResultsAsync(ScanResult result);
}

// === SAST - Static Application Security Testing ===
public class SastScanner
{
    public async Task<List<CodeVulnerability>> ScanCodeAsync(string repositoryPath)
    {
        var vulnerabilities = new List<CodeVulnerability>();
        
        // Pattern-based detection
        var patterns = new Dictionary<string, SecurityPattern>
        {
            ["SQL_INJECTION"] = new()
            {
                Regex = @"(string\.Format|[""'].*\+.*[""']).*(@"".*SELECT|INSERT|UPDATE|DELETE)",
                CweId = "CWE-89",
                Severity = CvssSeverity.Critical,
                Description = "SQL Injection المحتمل - استخدم parameterized queries"
            },
            ["XSS"] = new()
            {
                Regex = @"@Html\.Raw\(|innerHTML\s*=|dangerouslySetInnerHTML",
                CweId = "CWE-79",
                Severity = CvssSeverity.High,
                Description = "XSS المحتمل - استخدم HTML encoding"
            },
            ["HARDCODED_SECRET"] = new()
            {
                Regex = @"(password|secret|apikey|api_key|token)\s*=\s*[""'][^""']+[""']",
                CweId = "CWE-798",
                Severity = CvssSeverity.High,
                Description = "بيانات سرية مكتوبة في الكود - استخدم Key Vault"
            },
            ["INSECURE_CRYPTO"] = new()
            {
                Regex = ,
                CweId = ,
                Severity = CvssSeverity.Medium,
                Description = 
            },
            [] = ()
            {
                Regex = ,
                CweId = ,
                Severity = CvssSeverity.High,
                Description = 
            }
        };
        
        
         codeFiles = Directory.GetFiles(repositoryPath, , SearchOption.AllDirectories)
            .Where(f => f.EndsWith() || f.EndsWith() || f.EndsWith());
        
         (   codeFiles)
        {
             content =  File.ReadAllTextAsync();
             lines = content.Split();
            
             ( (patternName, pattern)  patterns)
            {
                 matches = Regex.Matches(content, pattern.Regex, RegexOptions.IgnoreCase);
                 (Match match  matches)
                {
                     lineNumber = content[..match.Index].Count(c => c == ) + ;
                    vulnerabilities.Add( CodeVulnerability
                    {
                        FilePath = ,
                        LineNumber = lineNumber,
                        CodeSnippet = lines[lineNumber - ].Trim(),
                        PatternName = patternName,
                        CweId = pattern.CweId,
                        Severity = pattern.Severity,
                        Description = pattern.Description
                    });
                }
            }
        }
        
         vulnerabilities;
    }
}


  
{
      Task<List<DependencyVulnerability>> CheckAsync( projectPath)
    {
        
         csprojFiles = Directory.GetFiles(projectPath, , SearchOption.AllDirectories);
         vulnerabilities =  List<DependencyVulnerability>();
        
         ( csproj  csprojFiles)
        {
             doc = XDocument.Load(csproj);
             packages = doc.Descendants()
                .Select(p =>  { 
                    Name = p.Attribute()?.Value,
                    Version = p.Attribute()?.Value 
                });
            
             ( pkg  packages)
            {
                
                 cves =  _nvdClient.SearchAsync(pkg.Name!, pkg.Version!);
                vulnerabilities.AddRange(cves.Select(cve =>  DependencyVulnerability
                {
                    PackageName = pkg.Name!,
                    CurrentVersion = pkg.Version!,
                    CveId = cve.Id,
                    CvssScore = cve.CvssScore,
                    FixedVersion = cve.FixedVersion,
                    Description = cve.Description
                }));
            }
        }
        
         vulnerabilities;
    }
}

SLA by Severity

public static class VulnerabilitySla
{
    // NCA-ECC aligned SLAs
    public static readonly Dictionary<CvssSeverity, TimeSpan> RemediationSla = new()
    {
        { CvssSeverity.Critical, TimeSpan.FromHours(24) },     // 24 ساعة
        { CvssSeverity.High, TimeSpan.FromDays(7) },           // 7 أيام
        { CvssSeverity.Medium, TimeSpan.FromDays(30) },        // 30 يوم
        { CvssSeverity.Low, TimeSpan.FromDays(90) },           // 90 يوم
        { CvssSeverity.None, TimeSpan.FromDays(180) }          // 180 يوم
    };
}

SQL Schema

CREATE SCHEMA [Security];

CREATE TABLE [Security].[Vulnerabilities] (
    [Id] INT IDENTITY(1,1) PRIMARY KEY,
    [VulnId] NVARCHAR(50) NOT NULL UNIQUE,
    [Title] NVARCHAR(500) NOT NULL,
    [Description] NVARCHAR(MAX) NOT NULL,
    [Type] NVARCHAR(30) NOT NULL,
    [Category] NVARCHAR(50) NOT NULL,
    [CveId] NVARCHAR(20) NULL,
    [CweId] NVARCHAR(20) NULL,
    [CvssScore] DECIMAL(3,1) NOT NULL,
    [Severity] NVARCHAR(10) NOT NULL,
    [IsExploitedInWild] BIT NOT NULL DEFAULT 0,
    [HasPublicExploit] BIT NOT NULL DEFAULT 0,
    [AssetId] INT NOT NULL,
    [Source] NVARCHAR(30) NOT NULL,
    [DiscoveredAt] DATETIME2 NOT NULL,
    [Status] NVARCHAR(20) NOT NULL DEFAULT 'New',
    [AssignedToId] INT NULL,
    [RemediationDueDate] DATETIME2 NULL,
    [RemediatedAt] DATETIME2 NULL,
    [IsSlaBreached] BIT NOT NULL DEFAULT 0,
    [CreatedAt] DATETIME2   GETUTCDATE(),
    INDEX IX_Severity_Status ([Severity], [Status]),
    INDEX IX_Asset ([AssetId])
);

 [Security].[Incidents] (
    [Id]  (,) ,
    [IncidentNumber] NVARCHAR()  ,
    [Title] NVARCHAR() ,
    [Severity] NVARCHAR() ,
    [Type] NVARCHAR() ,
    [Status] NVARCHAR()   ,
    [DataBreached] BIT   ,
    [DetectedAt] DATETIME2 ,
    [ContainedAt] DATETIME2 ,
    [RecoveredAt] DATETIME2 ,
    [IncidentCommanderId]  ,
    [CreatedAt] DATETIME2   GETUTCDATE()
);

 [Security].[Assets] (
    [Id]  (,) ,
    [Name] NVARCHAR() ,
    [Type] NVARCHAR() ,
    [IpAddress] NVARCHAR() ,
    [Hostname] NVARCHAR() ,
    [Criticality] NVARCHAR()   ,
    [DepartmentId]  ,
    [LastScanDate] DATETIME2 ,
    [OpenVulnerabilities]    
);


  [Security].[vw_VulnDashboard] 
 
    Severity,
    Status,
    ()  VulnCount,
    (  IsSlaBreached       )  SlaBreachedCount,
    (CvssScore)  AvgCvssScore
 [Security].[Vulnerabilities]
  Severity, Status;

  [Security].[vw_CriticalOpenVulns] 
 v., a.Name  AssetName, a.Criticality  AssetCriticality
 [Security].[Vulnerabilities] v
 [Security].[Assets] a  a.Id  v.AssetId
 v.Status   (,,)
     (v.Severity  (,)  v.IsExploitedInWild  )
  v.CvssScore , v.DiscoveredAt;

NCA-ECC Controls Mapping

ضابط NCA-ECC	الوصف	التنفيذ في المنصة
2-3-1	إدارة الثغرات	فحص دوري + معالجة حسب SLA
2-3-2	اختبار الاختراق	تقارير Pentest + متابعة
2-5-1	إدارة الحوادث	سير عمل Incident Response
2-7-1	أمن التطبيقات	SAST + DAST + SCA
2-9-1	أمن الشبكات	Network scanning
2-11-1	التشفير	فحص Cryptographic practices