vulnerability-management

# 🔍 Vulnerability Management Skill > **Strategic Principle**: Continuously identify, assess, and remediate vulnerabilities before they become incidents. ## 🎯 Purpose Enforce vulnerability management practices for Black Trigram, ensuring dependencies, code, and infrastructure are continuously scanned and vulnerabilities are remediated within defined SLAs. **Reference**: [Hack23 ISMS Vulnerability Management Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management_Policy.md) ## Enforcement Rules ### Rule 1: Dependency Scanning ``` IF (adding or updating npm dependency) THEN (run npm audit, check advisory database, verify license compatibility) ELSE (unscanned dependencies introduce supply chain risk) ``` ### Rule 2: Remediation SLAs ``` IF (vulnerability severity is Critical) THEN (patch within 24 hours) IF (vulnerability severity is High) THEN (patch within 72 hours) IF (vulnerability severity is Medium) THEN (patch within 2 weeks) IF (vulnerability severity is Low) THEN (patch within 30 days) ELSE (document risk acceptance with justification) ``` ### Rule 3: OSSF Scorecard Maintenance ``` IF (OSSF Scorecard score drops below 8.0) THEN (investigate and remediate failing checks) ELSE (maintain continuous improvement toward 10.0) ``` ### Rule 4: SBOM Generation ``` IF (release build) THEN (generate CycloneDX SBOM and publish as release artifact) ELSE (supply chain transparency gap) ``` ### Rule 5: Code Scanning ``` IF (code change in PR) THEN (CodeQL analysis must pass with zero high/critical findings) ELSE (vulnerable code merged to main branch) ``` ## Vulnerability Sources | Source | Scope | Automation | |--------|-------|-----------| | Dependabot | npm dependencies | Automatic PRs | | npm audit | Package vulnerabilities | CI pipeline | | CodeQL | Code vulnerabilities | PR checks | | Secret Scanning | Exposed credentials | Continuous | | OSSF Scorecard | Supply chain security | Scheduled | | Lighthouse | Web security headers | Release builds | ## Remediation Workflow ### 1. Detection ``` Automated scanning → Alert generated → Severity classified ``` ### 2. Assessment ``` - Verify vulnerability applies to our usage - Assess exploitability in our context - Determine affected components - Check for available patches ``` ### 3. Remediation ``` - Apply patch/update dependency - Run full test suite - Verify fix with security scanning - Document in changelog ``` ### 4. Verification ``` - Confirm vulnerability resolved - Check for regression - Update SBOM - Close security advisory ``` ## OSSF Scorecard Targets | Check | Target | Current | |-------|--------|---------| | Binary-Artifacts | 10 | Monitor | | Branch-Protection | 10 | Monitor | | Code-Review | 10 | Monitor | | Dangerous-Workflow | 10 | Monitor | | Dependency-Update-Tool | 10 | Monitor | | License | 10 | Monitor | | Maintained | 10 | Monitor | | Pinned-Dependencies | 10 | Monitor | | Security-Policy | 10 | Monitor | | Signed-Releases | 10 | Monitor | | Token-Permissions | 10 | Monitor | | Vulnerabilities | 10 | Monitor | ## npm Audit Integration ```bash # Run in CI pipeline npm audit --audit-level=high # Check specific packages npm audit --package-lock-only # Generate machine-readable output npm audit --json > audit-report.json ``` ## Testing Requirements - ✅ `npm audit` passes with no high/critical vulnerabilities - ✅ CodeQL analysis passes on all PRs - ✅ Dependabot alerts addressed within SLA - ✅ SBOM generated on releases - ✅ OSSF Scorecard score ≥ 8.0 - ✅ License compliance verified (`npm run test:licenses`) ## Compliance - **ISO 27001:2022**: A.8.8 (Management of technical vulnerabilities) - **NIST CSF 2.0**: ID.RA (Risk Assessment), DE.CM (Continuous Monitoring) - **CIS Controls v8.1**: 7 (Continuous Vulnerability Management) - **OWASP**: A06:2021 Vulnerable and Outdated Components - **Hack23 ISMS**: Vulnerability Management Policy --- **흑괘의 취약점 관리** - _Vulnerability Management of the Black Trigram_