vulnerability-management

# Vulnerability Management Skill ## Purpose This skill provides systematic procedures for proactive vulnerability discovery, intelligent remediation, and transparent security communication across the CIA platform. It implements Hack23's bleeding-edge dependency management strategy with automated testing, security validation, and measurable outcomes aligned with business impact. ## When to Use This Skill Apply this skill when: - ✅ Analyzing Dependabot pull requests for dependency updates - ✅ Responding to GitHub Security Advisories or CodeQL alerts - ✅ Triaging OWASP Dependency Check findings - ✅ Prioritizing vulnerability remediation across repositories - ✅ Managing SLA compliance for vulnerability fixes - ✅ Conducting security audits or compliance assessments - ✅ Implementing security patches for critical vulnerabilities - ✅ Tracking end-of-life (EOL) dependencies and runtimes Do NOT use for: - ❌ General code quality issues (use code-quality-checks skill) - ❌ Feature development (different concern) - ❌ Performance optimization (use performance-engineer agent) ## Decision Tree ```mermaid %%{ init: { 'theme': 'base', 'themeVariables': { 'primaryColor': '#D32F2F', 'primaryTextColor': '#fff', 'lineColor': '#D32F2F', 'secondaryColor': '#FF9800', 'tertiaryColor': '#4CAF50' } } }%% flowchart TD START["🔍 Vulnerability Detected"] --> SOURCE{"📊 Detection Source?"} SOURCE -->|Dependabot| DEPEND["📦 Dependency Vulnerability"] SOURCE -->|CodeQL| CODE["💻 Code Vulnerability"] SOURCE -->|OWASP| OWASP["🔍 Dependency Check Finding"] SOURCE -->|Security Advisory| ADVISORY["🚨 GitHub Advisory"] DEPEND --> CVSS{"🎯 CVSS Score?"} CODE --> CVSS OWASP --> CVSS ADVISORY --> CVSS CVSS -->|9.0-10.0| CRITICAL["🔴 Critical<br/>SLA: 7 days"] CVSS -->|7.0-8.9| HIGH["🟠 High<br/>SLA: 30 days"] CVSS -->|4.0-6.9| MEDIUM["🟡 Medium<br/>SLA: 90 days"] CVSS -->|0.1-3.9| LOW["🟢 Low<br/>SLA: 180 days"] CRITICAL --> EXPLOIT{"🎯 Exploited in Wild?"} HIGH --> IMPACT{"💼 Business Impact?"} MEDIUM --> CONTEXT{"🔍 Contextual Risk?"} LOW --> SCHEDULE["📅 Schedule Remediation"] EXPLOIT -->|YES| IMMEDIATE["⚡ Immediate Action<br/>4 hours target"] EXPLOIT -->|NO| VERIFY["✅ Verify Exploitability"] IMPACT -->|Significant| PRIORITY["🔴 High Priority"] IMPACT -->|Limited| STANDARD["🟡 Standard Priority"] CONTEXT -->|Reachable| ASSESS["🔍 Risk Assessment"] CONTEXT -->|Unreachable| BACKLOG["📋 Backlog"] IMMEDIATE --> REMEDIATE["🔧 Apply Remediation"] VERIFY --> REMEDIATE PRIORITY --> REMEDIATE STANDARD --> REMEDIATE ASSESS --> REMEDIATE SCHEDULE --> REMEDIATE BACKLOG --> MONITOR["👁️ Monitor for Changes"] REMEDIATE --> TEST["🧪 Test & Validate"] TEST --> DOCUMENT["📝 Document Resolution"] DOCUMENT --> CLOSE["✅ Close Vulnerability"] style START fill:#2196F3,color:#fff style CRITICAL fill:#D32F2F,color:#fff style HIGH fill:#FF9800,color:#fff style MEDIUM fill:#FFC107,color:#000 style LOW fill:#4CAF50,color:#fff style IMMEDIATE fill:#D32F2F,color:#fff style REMEDIATE fill:#1565C0,color:#fff style CLOSE fill:#4CAF50,color:#fff ``` ## CVSS v3.1 Severity Classification ### Severity Scoring Matrix **CVSS v3.1 Base Score Calculation:** | **Severity** | **CVSS Score** | **Business Impact** | **SLA** | **Escalation** | |--------------|----------------|---------------------|---------|----------------| | **🔴 Critical** | 9.0 - 10.0 | €10K+ daily loss | **7 days** | CEO immediate | | **🟠 High** | 7.0 - 8.9 | €5-10K daily loss | **30 days** | CEO within 1 day | | **🟡 Medium** | 4.0 - 6.9 | €1-5K daily loss | **90 days** | Weekly review | | **🟢 Low** | 0.1 - 3.9 | <€1K daily loss | **180 days** | Monthly review | ### CVSS Vector Analysis **Key CVSS Metrics to Evaluate:** ```yaml Attack_Vector (AV): - Network (N): Remotely exploitable = Higher severity - Adjacent (A): Local network required = Medium severity - Local (L): Local access required = Lower severity - Physical (P): Physical access required = Lowest severity Attack_Complexity (AC): - Low (L): Easy to exploit = Higher severity - High (H): Difficult to exploit = Lower severity Privileges_Required (PR): - None (N): No authentication = Highest severity - Low (L): Basic user privileges = Medium severity - High (H): Admin privileges = Lower severity User_Interaction (UI): - None (N): No user action required = Higher severity - Required (R): User must take action = Lower severity Scope (S): - Changed (C): Impacts beyond vulnerable component = Higher severity - Unchanged (U): Impact limited to component = Lower severity Confidentiality_Impact (C): - High (H): Total information disclosure = Highest severity - Low (L): Limited disclosure = Medium severity - None (N): No confidentiality impact = Lowest severity Integrity_Impact (I): - High (H): Complete data modification = Highest severity - Low (L): Limited modification = Medium severity - None (N): No integrity impact = Lowest severity Availability_Impact (A): - High (H): Complete system unavailability = Highest severity - Low (L): Reduced performance = Medium severity - None (N): No availability impact = Lowest severity ``` **Example CVSS Vector:** ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Base Score: 10.0 (Critical) Interpretation: Remotely exploitable, easy to exploit, no authentication, scope change, high impact to confidentiality/integrity/availability ``` ## Vulnerability Lifecycle Management ### Phase 1: Discovery **Automated Detection Sources:** ```yaml GitHub_Dependabot: - Frequency: Real-time alerts - Coverage: npm, Maven, pip, Docker, GitHub Actions - Action: Auto-creates PR with fix - Integration: .github/dependabot.yml GitHub_CodeQL: - Frequency: On push, PR, scheduled scan - Coverage: Java, JavaScript, Python code vulnerabilities - Action: Creates security alert - Integration: .github/workflows/codeql.yml OWASP_Dependency_Check: - Frequency: Daily via CI/CD - Coverage: All Maven dependencies - Action: Fails build if critical found - Integration: pom.xml plugin configuration GitHub_Security_Advisories: - Frequency: Real-time notifications - Coverage: All dependencies and platforms - Action: Email + dashboard alert - Integration: Repository settings SonarCloud: - Frequency: On push, PR - Coverage: Code quality + security hotspots - Action: Quality gate failure - Integration: .github/workflows/verify-release.yml ``` **Manual Discovery Methods:** - Security researcher disclosure (SECURITY.md) - Penetration testing findings - Third-party security audit - Customer vulnerability report ### Phase 2: Assessment **Contextual Risk Evaluation:** ```mermaid flowchart LR VULN["🔍 Vulnerability"] --> CVSS["📊 CVSS Score"] VULN --> EXPLOIT["💣 Exploitability"] VULN --> ATTACK["🎯 Attack Surface"] VULN --> DATA["🔐 Data Exposure"] CVSS --> RISK["⚖️ Risk Score"] EXPLOIT --> RISK ATTACK --> RISK DATA --> RISK RISK --> CRITICAL{"🔴 Critical Risk?"} RISK --> HIGH{"🟠 High Risk?"} RISK --> MEDIUM{"🟡 Medium Risk?"} RISK --> LOW{"🟢 Low Risk?"} CRITICAL --> IMMEDIATE["⚡ Immediate Action"] HIGH --> URGENT["🔴 Urgent Action"] MEDIUM --> SCHEDULED["📅 Scheduled Action"] LOW --> BACKLOG["📋 Backlog"] style VULN fill:#2196F3,color:#fff style RISK fill:#FF9800,color:#fff style CRITICAL fill:#D32F2F,color:#fff style IMMEDIATE fill:#D32F2F,color:#fff ``` **Assessment Checklist:** - [ ] **CVSS Score:** Base score from NVD or GitHub Advisory - [ ] **Exploitability:** POC available? Exploited in wild? - [ ] **Attack Surface:** Is vulnerable component reachable? - [ ] **Data Classification:** What data class does component handle? - [ ] **Business Impact:** Revenue/operations/reputation impact? - [ ] **Fix Availability:** Patch available? Workaround possible? - [ ] **Blast Radius:** How many systems affected? - [ ] **Regulatory Impact:** GDPR/NIS2/SOC2 implications? ### Phase 3: Remediation **Remediation Strategies:** ```yaml Patch_Update: - Action: Apply vendor security patch - Priority: Preferred solution - Risk: Low (tested by vendor) - Example: "Update Spring Boot 2.7.5 → 2.7.18" Version_Upgrade: - Action: Upgrade to non-vulnerable version - Priority: Standard approach - Risk: Medium (breaking changes possible) - Example: "Upgrade Vaadin 14.x → 23.x" Configuration_Change: - Action: Disable vulnerable feature - Priority: Quick mitigation - Risk: Low (functionality may be reduced) - Example: "Disable XML external entity processing" Virtual_Patch: - Action: WAF rule or network control - Priority: Temporary mitigation - Risk: Medium (bypass possible) - Example: "Block exploit pattern in AWS WAF" Replace_Component: - Action: Switch to alternative library - Priority: Last resort - Risk: High (significant refactoring) - Example: "Replace Log4j with Logback" Accept_Risk: - Action: Document risk acceptance - Priority: Only with CEO approval - Risk: Varies (requires monitoring) - Example: "Low CVSS + unreachable code + no fix available" ``` **Remediation Workflow:** ```bash # 1. Create remediation branch git checkout -b security/CVE-2024-XXXXX-remediation git pull origin main # 2. Apply fix (example: dependency update) # Edit pom.xml or use Maven versions plugin mvn versions:use-latest-versions -Dincludes=org.springframework:spring-core # 3. Build and test mvn clean install mvn test mvn verify # 4. Security validation mvn dependency-check:check # Review report: target/dependency-check-report.html # 5. Commit with security context git add pom.xml git commit -m "security: fix CVE-2024-XXXXX in Spring Core - Update Spring Core 5.3.20 → 5.3.30 - CVSS Score: 9.8 (Critical) - Vulnerability: Remote Code Execution - Fixes: https://github.com/advisories/GHSA-xxxx-xxxx-xxxx - Tested: All unit tests pass, security scan clean Refs: #1234" # 6. Push and create PR git push origin security/CVE-2024-XXXXX-remediation gh pr create --title "Security: Fix CVE-2024-XXXXX" \ --body "Fixes critical vulnerability in Spring Core" \ --label "security,priority:critical" ``` ### Phase 4: Verification **Verification Checklist:** ```markdown ## Security Fix Verification - [ ] **Vulnerability Resolved:** Confirmed by security scanner - [ ] **No New Vulnerabilities:** Dependency check clean - [ ] **Unit Tests Pass:** `mvn test` successful - [ ] **Integration Tests Pass:** `mvn verify` successful - [ ] **Security Tests Pass:** CodeQL analysis clean - [ ] **Performance Impact:** No degradation observed - [ ] **Compatibility Check:** No breaking changes introduced - [ ] **Documentation Updated:** CHANGELOG.md updated - [ ] **Security Advisory Reviewed:** GitHub advisory closed **Evidence:** - Dependency Check Report: target/dependency-check-report.html - CodeQL Scan: Clean (0 alerts) - Test Coverage: 82% (maintained) - Build Status: ✅ Success ``` **Automated Verification:** ```yaml # .github/workflows/security-verification.yml name: Security Verification on: pull_request: branches: [ main ] labels: [ security ] jobs: verify-security-fix: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up JDK 21 uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0 with: java-version: '21' distribution: 'temurin' - name: Run OWASP Dependency Check run: mvn dependency-check:check -P dependency-check - name: Check for vulnerabilities run: | if grep -q "Critical" target/dependency-check-report.html; then echo "❌ Critical vulnerabilities still present" exit 1 fi echo "✅ No critical vulnerabilities detected" - name: Run security tests run: mvn test -Dsecurity.test=true - name: Upload verification report uses: actions/upload-artifact@ea165860e890e4c0d99e2a7e241d52ce9fdf0b90 # v4.5.0 with: name: security-verification-report path: target/dependency-check-report.html ``` ### Phase 5: Closure **Closure Criteria:** 1. ✅ Fix deployed to production 2. ✅ Vulnerability scanner confirms resolution 3. ✅ GitHub Security Advisory dismissed or closed 4. ✅ Documentation updated (CHANGELOG.md) 5. ✅ Stakeholders notified 6. ✅ Lessons learned documented **Closure Documentation:**