vulnerability-management

name	vulnerability-management
description	Enforces continuous vulnerability identification, assessment, and remediation for Black Trigram — Dependabot, npm audit, CodeQL, SLA-based patching, OSSF Scorecard ≥8.0, CycloneDX SBOM, aligned with Hack23 Vulnerability Management policy
license	MIT

🔍 Vulnerability Management Skill

Strategic Principle: Continuously identify, assess, and remediate vulnerabilities before they become incidents.

🎯 Purpose

Enforce vulnerability management practices for Black Trigram, ensuring dependencies, code, and infrastructure are continuously scanned and vulnerabilities are remediated within defined SLAs.

Reference: Hack23 ISMS Vulnerability Management Policy

Enforcement Rules

Rule 1: Dependency Scanning

IF (adding or updating npm dependency)
THEN (run npm audit, check advisory database, verify license compatibility)
ELSE (unscanned dependencies introduce supply chain risk)

Rule 2: Remediation SLAs

IF (vulnerability severity is Critical) THEN (patch within 24 hours)
IF (vulnerability severity is High) THEN (patch within 72 hours)
IF (vulnerability severity is Medium) THEN (patch within 2 weeks)
IF (vulnerability severity is Low) THEN (patch within 30 days)
ELSE (document risk acceptance with justification)

Rule 3: OSSF Scorecard Maintenance

IF (OSSF Scorecard score drops below 8.0)
THEN (investigate and remediate failing checks)
ELSE (maintain continuous improvement toward 10.0)

Rule 4: SBOM Generation

IF (release build)
THEN (generate CycloneDX SBOM and publish as release artifact)
ELSE (supply chain transparency gap)

Rule 5: Code Scanning

IF (code change in PR)
THEN (CodeQL analysis must pass with zero high/critical findings)
ELSE (vulnerable code merged to main branch)

Vulnerability Sources

Source	Scope	Automation
Dependabot	npm dependencies	Automatic PRs
npm audit	Package vulnerabilities	CI pipeline
CodeQL	Code vulnerabilities	PR checks
Secret Scanning	Exposed credentials	Continuous
OSSF Scorecard	Supply chain security	Scheduled
Lighthouse	Web security headers	Release builds

Remediation Workflow

1. Detection

Automated scanning → Alert generated → Severity classified

2. Assessment

- Verify vulnerability applies to our usage
- Assess exploitability in our context
- Determine affected components
- Check for available patches

3. Remediation

- Apply patch/update dependency
- Run full test suite
- Verify fix with security scanning
- Document in changelog

4. Verification

- Confirm vulnerability resolved
- Check for regression
- Update SBOM
- Close security advisory

OSSF Scorecard Targets

Check	Target	Current
Binary-Artifacts	10	Monitor
Branch-Protection	10	Monitor
Code-Review	10	Monitor
Dangerous-Workflow	10	Monitor
Dependency-Update-Tool	10	Monitor
License	10	Monitor
Maintained	10	Monitor
Pinned-Dependencies	10	Monitor
Security-Policy	10	Monitor
Signed-Releases	10	Monitor
Token-Permissions	10	Monitor
Vulnerabilities	10	Monitor

npm Audit Integration

# Run in CI pipeline
npm audit --audit-level=high

# Check specific packages
npm audit --package-lock-only

# Generate machine-readable output
npm audit --json > audit-report.json

Testing Requirements

• ✅ npm audit passes with no high/critical vulnerabilities
• ✅ CodeQL analysis passes on all PRs
• ✅ Dependabot alerts addressed within SLA
• ✅ SBOM generated on releases
• ✅ OSSF Scorecard score ≥ 8.0
• ✅ License compliance verified (npm run test:licenses)

Compliance

• ISO 27001:2022: A.8.8 (Management of technical vulnerabilities)
• NIST CSF 2.0: ID.RA (Risk Assessment), DE.CM (Continuous Monitoring)
• CIS Controls v8.1: 7 (Continuous Vulnerability Management)
• OWASP: A06:2021 Vulnerable and Outdated Components
• Hack23 ISMS: Vulnerability Management Policy

---

흑괘의 취약점 관리 - Vulnerability Management of the Black Trigram