vulnerability-management

---

name: vulnerability-management description: Systematic vulnerability lifecycle management with SLAs: Critical 7d, High 30d, Medium 90d, Low 180d aligned with OWASP, NIST, CIS Controls license: Apache-2.0

Vulnerability Management Skill

Purpose

This skill provides systematic procedures for proactive vulnerability discovery, intelligent remediation, and transparent security communication across the CIA platform. It implements Hack23's bleeding-edge dependency management strategy with automated testing, security validation, and measurable outcomes aligned with business impact.

When to Use This Skill

Apply this skill when:

• ✅ Analyzing Dependabot pull requests for dependency updates
• ✅ Responding to GitHub Security Advisories or CodeQL alerts
• ✅ Triaging OWASP Dependency Check findings
• ✅ Prioritizing vulnerability remediation across repositories
• ✅ Managing SLA compliance for vulnerability fixes
• ✅ Conducting security audits or compliance assessments
• ✅ Implementing security patches for critical vulnerabilities
• ✅ Tracking end-of-life (EOL) dependencies and runtimes

Do NOT use for:

• ❌ General code quality issues (use code-quality-checks skill)
• ❌ Feature development (different concern)
• ❌ Performance optimization (use performance-engineer agent)

Decision Tree

%%{
  init: {
    'theme': 'base',
    'themeVariables': {
      'primaryColor': '#D32F2F',
      'primaryTextColor': '#fff',
      'lineColor': '#D32F2F',
      'secondaryColor': '#FF9800',
      'tertiaryColor': '#4CAF50'
    }
  }
}%%
flowchart TD
    START["🔍 Vulnerability Detected"] --> SOURCE{"📊 Detection Source?"}
    
    SOURCE -->|Dependabot| DEPEND["📦 Dependency Vulnerability"]
    SOURCE -->|CodeQL| CODE["💻 Code Vulnerability"]
    SOURCE -->|OWASP| OWASP["🔍 Dependency Check Finding"]
    SOURCE -->|Security Advisory| ADVISORY["🚨 GitHub Advisory"]
    
    DEPEND --> CVSS{"🎯 CVSS Score?"}
    CODE --> CVSS
    OWASP --> CVSS
    ADVISORY --> CVSS
    
    CVSS -->|9.0-10.0| CRITICAL["🔴 Critical<br/>SLA: 7 days"]
    CVSS -->|7.0-8.9| HIGH["🟠 High<br/>SLA: 30 days"]
    CVSS -->|4.0-6.9| MEDIUM["🟡 Medium<br/>SLA: 90 days"]
    CVSS -->|0.1-3.9| LOW["🟢 Low<br/>SLA: 180 days"]
    
    CRITICAL --> EXPLOIT{"🎯 Exploited in Wild?"}
    HIGH --> IMPACT{"💼 Business Impact?"}
    MEDIUM --> CONTEXT{"🔍 Contextual Risk?"}
    LOW --> SCHEDULE["📅 Schedule Remediation"]
    
    EXPLOIT -->|YES| IMMEDIATE["⚡ Immediate Action<br/>4 hours target"]
    EXPLOIT -->|NO| VERIFY["✅ Verify Exploitability"]
    
    IMPACT -->|Significant| PRIORITY["🔴 High Priority"]
    IMPACT -->|Limited| STANDARD["🟡 Standard Priority"]
    
    CONTEXT -->|Reachable| ASSESS["🔍 Risk Assessment"]
    CONTEXT -->|Unreachable| BACKLOG["📋 Backlog"]
    
    IMMEDIATE --> REMEDIATE["🔧 Apply Remediation"]
    VERIFY --> REMEDIATE
    PRIORITY --> REMEDIATE
    STANDARD --> REMEDIATE
    ASSESS --> REMEDIATE
    SCHEDULE --> REMEDIATE
    BACKLOG --> MONITOR["👁️ Monitor for Changes"]
    
    REMEDIATE --> TEST["🧪 Test & Validate"]
    TEST --> DOCUMENT["📝 Document Resolution"]
    DOCUMENT --> CLOSE["✅ Close Vulnerability"]
    
    style START fill:#2196F3,color:#fff
    style CRITICAL fill:#D32F2F,color:#fff
    style HIGH fill:#FF9800,color:#fff
    style MEDIUM fill:#FFC107,color:#000
    style LOW fill:#4CAF50,color:#fff
    style IMMEDIATE fill:#D32F2F,color:#fff
    style REMEDIATE fill:#1565C0,color:#fff
    style CLOSE fill:#4CAF50,color:#fff

CVSS v3.1 Severity Classification

Severity Scoring Matrix

CVSS v3.1 Base Score Calculation:

Severity	CVSS Score	Business Impact	SLA	Escalation
🔴 Critical	9.0 - 10.0	€10K+ daily loss	7 days	CEO immediate
🟠 High	7.0 - 8.9	€5-10K daily loss	30 days	CEO within 1 day
🟡 Medium	4.0 - 6.9	€1-5K daily loss	90 days	Weekly review
🟢 Low	0.1 - 3.9	<€1K daily loss	180 days	Monthly review

CVSS Vector Analysis

Key CVSS Metrics to Evaluate:

Attack_Vector (AV):
  - Network (N): Remotely exploitable = Higher severity
  - Adjacent (A): Local network required = Medium severity
  - Local (L): Local access required = Lower severity
  - Physical (P): Physical access required = Lowest severity

Attack_Complexity (AC):
  - Low (L): Easy to exploit = Higher severity
  - High (H): Difficult to exploit = Lower severity

Privileges_Required (PR):
  - None (N): No authentication = Highest severity
  -       
        


          
          


          
          


         
        
         


         
        
         


         
        
         

Example CVSS Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score: 10.0 (Critical)
Interpretation: Remotely exploitable, easy to exploit, no authentication,
               scope change, high impact to confidentiality/integrity/availability

Vulnerability Lifecycle Management

Phase 1: Discovery

Automated Detection Sources:

GitHub_Dependabot:
  - Frequency: Real-time alerts
  - Coverage: npm, Maven, pip, Docker, GitHub Actions
  - Action: Auto-creates PR with fix
  - Integration: .github/dependabot.yml

GitHub_CodeQL:
  - Frequency: On push, PR, scheduled scan
  - Coverage: Java, JavaScript, Python code vulnerabilities
  - Action: Creates security alert
  - Integration: .github/workflows/codeql.yml

OWASP_Dependency_Check:
  - Frequency: Daily via CI/CD
  - Coverage: All Maven dependencies
  - Action:     
      


     
       
       
     


      
        
      
    

Manual Discovery Methods:

• Security researcher disclosure (SECURITY.md)
• Penetration testing findings
• Third-party security audit
• Customer vulnerability report

Phase 2: Assessment

Contextual Risk Evaluation:

flowchart LR
    VULN["🔍 Vulnerability"] --> CVSS["📊 CVSS Score"]
    VULN --> EXPLOIT["💣 Exploitability"]
    VULN --> ATTACK["🎯 Attack Surface"]
    VULN --> DATA["🔐 Data Exposure"]
    
    CVSS --> RISK["⚖️ Risk Score"]
    EXPLOIT --> RISK
    ATTACK --> RISK
    DATA --> RISK
    
    RISK --> CRITICAL{"🔴 Critical Risk?"}
    RISK --> HIGH{"🟠 High Risk?"}
    RISK --> MEDIUM{"🟡 Medium Risk?"}
    RISK --> LOW{"🟢 Low Risk?"}
    
    CRITICAL --> IMMEDIATE["⚡ Immediate Action"]
    HIGH --> URGENT["🔴 Urgent Action"]
    MEDIUM --> SCHEDULED["📅 Scheduled Action"]
    LOW --> BACKLOG["📋 Backlog"]
    
    style VULN fill:#2196F3,color:#fff
    style RISK fill:#FF9800,color:#fff
    style CRITICAL fill:#D32F2F,color:#fff
    style IMMEDIATE fill:#D32F2F,color:#fff

Assessment Checklist:

• CVSS Score: Base score from NVD or GitHub Advisory
• Exploitability: POC available? Exploited in wild?
• Attack Surface: Is vulnerable component reachable?
• Data Classification: What data class does component handle?
• Business Impact: Revenue/operations/reputation impact?
• Fix Availability: Patch available? Workaround possible?
• Blast Radius: How many systems affected?
• Regulatory Impact: GDPR/NIS2/SOC2 implications?

Phase 3: Remediation

Remediation Strategies:

Patch_Update:
  - Action: Apply vendor security patch
  - Priority: Preferred solution
  - Risk: Low (tested by vendor)
  - Example: "Update Spring Boot 2.7.5 → 2.7.18"

Version_Upgrade:
  - Action: Upgrade to non-vulnerable version
  - Priority: Standard approach
  - Risk: Medium (breaking changes possible)
  - Example: "Upgrade Vaadin 14.x → 23.x"

Configuration_Change:
  - Action: Disable vulnerable feature
  - Priority: Quick mitigation
  - Risk: Low (functionality may be reduced)
    


        
     
      
    


       
     
      
    


      
       
      
    

Remediation Workflow:

# 1. Create remediation branch
git checkout -b security/CVE-2024-XXXXX-remediation
git pull origin main

# 2. Apply fix (example: dependency update)
# Edit pom.xml or use Maven versions plugin
mvn versions:use-latest-versions -Dincludes=org.springframework:spring-core

# 3. Build and test
mvn clean install
mvn test
mvn verify

# 4. Security validation
mvn dependency-check:check
# Review report: target/dependency-check-report.html

# 5. Commit with security context
git add pom.xml
git commit -m "security: fix CVE-2024-XXXXX in Spring Core

- Update Spring Core 5.3.20 → 5.3.30
- CVSS Score: 9.8 (Critical)
- Vulnerability: Remote Code Execution
- Fixes: https://github.com/advisories/GHSA-xxxx-xxxx-xxxx
- Tested: All unit tests pass, security scan clean

Refs: #1234"

# 6. Push and create PR
git push origin security/CVE-2024-XXXXX-remediation
gh pr create --title "Security: Fix CVE-2024-XXXXX" \
  --body "Fixes critical vulnerability in Spring Core" \
  --label "security,priority:critical"

Phase 4: Verification

Verification Checklist:

## Security Fix Verification

- [ ] **Vulnerability Resolved:** Confirmed by security scanner
- [ ] **No New Vulnerabilities:** Dependency check clean
- [ ] **Unit Tests Pass:** `mvn test` successful
- [ ] **Integration Tests Pass:** `mvn verify` successful
- [ ] **Security Tests Pass:** CodeQL analysis clean
- [ ] **Performance Impact:** No degradation observed
- [ ] **Compatibility Check:** No breaking changes introduced
- [ ] **Documentation Updated:** CHANGELOG.md updated
- [ ] **Security Advisory Reviewed:** GitHub advisory closed

**Evidence:**
- Dependency Check Report: target/dependency-check-report.html
- CodeQL Scan: Clean (0 alerts)
- Test Coverage: 82% (maintained)
- Build Status: ✅ Success

Automated Verification:

# .github/workflows/security-verification.yml
name: Security Verification

on:
  pull_request:
    branches: [ main ]
    labels: [ security ]

jobs:
  verify-security-fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      
      - name: Set up JDK 21
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
        with:
          java-version: '21'
          distribution: 'temurin'
      
      - name: Run OWASP Dependency Check
        run: mvn dependency-check:check -P dependency-check
      
      - name: Check for vulnerabilities
        run: |
          if grep -q "Critical" target/dependency-check-report.html; then
            echo "❌ Critical vulnerabilities still present"
            exit 1
          fi
          echo "✅ No critical vulnerabilities detected"
      
          
           
      
          
          
        
           
           

Phase 5: Closure

Closure Criteria:

1. ✅ Fix deployed to production
2. ✅ Vulnerability scanner confirms resolution
3. ✅ GitHub Security Advisory dismissed or closed
4. ✅ Documentation updated (CHANGELOG.md)
5. ✅ Stakeholders notified
6. ✅ Lessons learned documented

Closure Documentation:

# Vulnerability CVE-2024-XXXXX - Closure Report

## Summary
- **Vulnerability ID:** CVE-2024-XXXXX
- **Severity:** Critical (CVSS 9.8)
- **Component:** Spring Core 5.3.20
- **Detected:** 2024-01-15
- **Resolved:** 2024-01-16
- **SLA:** 7 days (Met: 1 day)

## Resolution
- **Action:** Version upgrade
- **Fix:** Spring Core 5.3.20 → 5.3.30
- **PR:** #1234
- **Deployment:** 2024-01-16 14:30 UTC

## Verification
- ✅ OWASP Dependency Check: Clean
- ✅ CodeQL Scan: No alerts
- ✅ Unit Tests: 100% pass
- ✅ Integration Tests: 100% pass
- ✅ Security Regression Tests: Pass

## Lessons Learned
- **Detection:** Dependabot alert received within 2 hours
- **Triage:** Severity confirmed in 30 minutes
- **Fix:** Patch applied in 4 hours
- **Deployment:** Production rollout in 24 hours
- **Improvement:** Consider auto-merge for patch-level security updates

## References
- GitHub Advisory: https://github.com/advisories/GHSA-xxxx-xxxx-xxxx
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-XXXXX
- Spring Security Advisory: https://spring.io/security/cve-2024-xxxxx

SLA Tracking and Escalation

SLA Monitoring

Automated SLA Tracking:

# .github/workflows/vulnerability-sla-monitoring.yml
name: Vulnerability SLA Monitoring

on:
  schedule:
    - cron: '0 9 * * *' # Daily at 9 AM UTC
  workflow_dispatch:

jobs:
  check-sla:
    runs-on: ubuntu-latest
    steps:
      - name: Check Dependabot Alerts
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const { data: alerts } = await github.rest.dependabot.listAlertsForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open'
            });
            
            const now = new Date();
            const criticalSLA = 7 * 24 * 60 * 60 * 1000; // 7 days
            const highSLA =            
            
               []
            
                 {
                  
                   
                 
              
                      {
                  {}
              }          {
                  {}
              }
            }
            
                {
                {}
                 , , 
            }

Escalation Procedures

Escalation Matrix:

Severity	Age Threshold	Escalation Level	Action
Critical	3 days (42% of SLA)	Level 1: Development Team	Daily standup review
Critical	5 days (71% of SLA)	Level 2: Team Lead	Risk assessment required
Critical	7 days (100% of SLA)	Level 3: CEO	Exception approval needed
High	15 days (50% of SLA)	Level 1: Development Team	Weekly review
High	25 days (83% of SLA)	Level 2: Team Lead	Remediation plan required
High	30 days (100% of SLA)	Level 3: CEO	Exception approval needed

Escalation Template:

# SLA Escalation Notice

**To:** CEO / Security Team Lead
**From:** Automated SLA Monitor
**Date:** 2024-01-15
**Priority:** 🔴 URGENT

## SLA Breach Alert

**Vulnerability:** CVE-2024-XXXXX
**Severity:** Critical (CVSS 9.8)
**Component:** Spring Core 5.3.20
**Age:** 6 days (86% of 7-day SLA)
**Status:** In Progress

## Current Status
- PR #1234 created for remediation
- Blocked on: Integration test failures
- Estimated Resolution: 2024-01-16

## Required Action
- [ ] CEO acknowledgment
- [ ] Risk acceptance or remediation prioritization
- [ ] Resource allocation if needed

## Impact Assessment
- **Exploitability:** High (POC available)
- **Attack Surface:** Internet-facing API
- **Data at Risk:** Customer PII
- **Business Impact:** €15K/day potential loss

## Escalation History
- Day 3: Development team notified
- Day 5: Team lead engaged
- Day 6: CEO escalation (this notice)

Exception Handling

Risk Acceptance Process

When to Accept Risk:

• Fix not available from vendor
• Fix introduces breaking changes requiring major refactoring
• Vulnerable code path is unreachable
• Compensating controls adequately mitigate risk
• Business justification outweighs risk

Risk Acceptance Template:

# Vulnerability Risk Acceptance

**Date:** 2024-01-15
**Valid Until:** 2024-04-15 (90 days max)
**Approved By:** CEO

## Vulnerability Details
- **CVE ID:** CVE-2024-XXXXX
- **Severity:** Medium (CVSS 5.5)
- **Component:** Apache Commons Text 1.9
- **Description:** Regular expression denial of service

## Risk Assessment
- **Exploitability:** Low (requires specific input pattern)
- **Attack Surface:** Internal admin API only (not public)
- **Data Impact:** None (no data exposure)
- **Business Impact:** Minimal (temporary performance degradation)

## Justification
- Vendor fix not yet available
- Component used only in internal admin tools
- Compensating controls: Input validation + rate limiting
- Monitoring: CloudWatch alarms on API latency

## Compensating Controls
1. ✅ Input validation regex pattern: `^[a-zA-Z0-9_-]{1,50}$`
2. ✅ API rate limiting: 10 requests/minute
3. ✅ Monitoring: CloudWatch alarm on p99 latency >500ms
4. ✅ WAF rule: Block suspicious patterns

## Review Schedule
- **Next Review:** 2024-02-15 (30 days)
- **Re-evaluation Trigger:** Vendor patch release
- **Maximum Duration:** 90 days from approval

## Approval
- **Approver:** James Pether Sörling, CEO
  2024-01-15
  [Digital signature or commit SHA]

 Documented in Risk Register, monitored monthly

Integration with CIA Platform

Dependabot Configuration

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "security"
    reviewers:
      - "hack23"
    commit-message:
      prefix: "security"
      include: "scope"
    
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "github-actions"
      - "security"
    commit-message:
      prefix: "ci"

OWASP Dependency Check Configuration

<!-- pom.xml -->
<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>10.0.4</version>
  <configuration>
    <failBuildOnCVSS>7</failBuildOnCVSS>
    <suppressionFiles>
      <suppressionFile>owasp-suppressions.xml</suppressionFile>
    </suppressionFiles>
    <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
  </configuration>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
</plugin>

CodeQL Configuration

# .github/workflows/codeql.yml
name: "CodeQL"

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 6 * * 1' # Weekly Monday 6 AM

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
        with:
          languages: java
          queries: security-extended

      - name: Build
        run: mvn clean  

          
          

Compliance Mapping

ISO 27001:2022

• A.8.8 - Management of Technical Vulnerabilities
• A.5.7 - Threat Intelligence
• A.8.16 - Monitoring Activities

NIST CSF 2.0

• DE.CM-8 - Vulnerability scans are performed
• RS.MA-1 - Incidents are contained
• PR.DS-6 - Integrity checking mechanisms verify software integrity

CIS Controls v8

• Control 7 - Continuous Vulnerability Management
• Control 7.1 - Establish and Maintain Vulnerability Management Process
• Control 7.2 - Establish and Maintain Remediation Process
• Control 7.3 - Perform Automated Operating System Patch Management
• Control 7.4 - Perform Automated Application Patch Management
• Control 7.5 - Perform Automated Vulnerability Scans

OWASP Top 10 2021

• A06:2021 - Vulnerable and Outdated Components
• A08:2021 - Software and Data Integrity Failures

References

• Hack23 ISMS: Vulnerability Management Policy
• NIST SP 800-40r4: Guide to Enterprise Patch Management Planning
• OWASP Dependency Check: https://owasp.org/www-project-dependency-check/
• GitHub Security Advisories: https://docs.github.com/en/code-security/security-advisories
• NVD CVSS Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
• CWE Top 25: https://cwe.mitre.org/top25/

Examples from CIA Platform

Successful Vulnerability Remediation

CVE-2023-20863 - Spring Expression DoS (CVSS 7.5)

# 1. Detected by Dependabot
# Alert: https://github.com/Hack23/cia/security/dependabot/123

# 2. Assessment (30 minutes)
# Severity: High
# Component: spring-expression 5.3.25
# Impact: DoS possible via crafted SpEL expression
# Exploitability: Low (requires admin privileges)
# SLA: 30 days

# 3. Remediation (4 hours)
git checkout -b security/spring-expression-dos
mvn versions:set-property -Dproperty=spring.version -DnewVersion=5.3.27
mvn clean install
git commit -m "security: fix CVE-2023-20863 Spring Expression DoS"
git push origin security/spring-expression-dos

# 4. Verification
# - OWASP Dependency Check: Clean
# - All tests pass: 2,847 tests
# - CodeQL: No new alerts

# 5. Deployment
# Merged to main, deployed to production
# Total time: 1 day (well within 30-day SLA)

Appendix: Tools and Resources

Security Scanning Tools

Tools_Used:
  Dependabot:
    Purpose: Automated dependency updates
    Coverage: Maven, npm, GitHub Actions
    Integration: GitHub native
    Cost: Free for public repos

  OWASP_Dependency_Check:
    Purpose: Known vulnerability detection
    Coverage: Maven dependencies
    Integration: Maven plugin
    Cost: Free

  CodeQL:
    Purpose: Code vulnerability scanning
    Coverage: Java, JavaScript, Python
    Integration: GitHub Actions
    Cost: Free for public repos

  SonarCloud:
    Purpose: Code quality + security hotspots
       
      
        

  
      
      
      
     

Useful Commands

# Check for vulnerabilities in Maven project
mvn dependency-check:check

# Update all dependencies to latest versions
mvn versions:use-latest-versions

# List outdated dependencies
mvn versions:display-dependency-updates

# Generate dependency tree
mvn dependency:tree

# Check for dependency conflicts
mvn dependency:analyze

# Run security-focused tests
mvn test -Dsecurity.test=true

# Generate SBOM (Software Bill of Materials)
mvn cyclonedx:makeAggregateBom

---

Document Maintenance:

• Review Frequency: Quarterly
• Last Updated: 2024-01-15
• Next Review: 2024-04-15
• Owner: Security Team / CIA Project Maintainers