vulnerability-management

# Vulnerability Management Skill ## Purpose Provide systematic procedures for proactive vulnerability discovery, intelligent remediation, and transparent security communication across all Hack23 projects, with measurable SLAs aligned with business impact. ## Rules ### Severity Classification and SLAs | Severity | CVSS Score | SLA | Escalation | |----------|-----------|-----|------------| | **Critical** | 9.0-10.0 | 7 days | CEO immediate | | **High** | 7.0-8.9 | 30 days | CEO within 1 day | | **Medium** | 4.0-6.9 | 90 days | Weekly review | | **Low** | 0.1-3.9 | 180 days | Monthly review | ### Detection Sources **MUST** enable on all repositories: - GitHub Dependabot for automated dependency vulnerability alerts - GitHub CodeQL for code-level vulnerability scanning - GitHub Secret Scanning for credential exposure - OWASP Dependency Check (where applicable) ### Vulnerability Lifecycle **Phase 1: Discovery** - **MUST** enable automated scanning on all repositories - **MUST** process vulnerability alerts within 24 hours of detection **Phase 2: Assessment** - **MUST** evaluate CVSS score, exploitability, attack surface, and data exposure - **MUST** consider contextual risk (is the vulnerable component reachable?) - **MUST** document risk assessment for each vulnerability **Phase 3: Remediation** - **MUST** prioritize patches and version upgrades as primary remediation - **MUST** create security-prefixed branches for fixes: `security/CVE-YYYY-XXXXX` - **MUST** include CVE reference and CVSS score in commit messages - **MUST** validate fix with security scanners before merging **Phase 4: Verification** - **MUST** confirm vulnerability resolved by security scanner - **MUST** ensure no new vulnerabilities introduced - **MUST** pass all existing tests **Phase 5: Closure** - **MUST** document resolution in changelog - **MUST** close associated GitHub Security Advisory - **MUST** conduct lessons-learned for Critical/High severity ### Risk Acceptance Risk acceptance **MUST**: - Be approved by CEO - Be valid for maximum 90 days - Include documented compensating controls - Be tracked in the risk register - Be reviewed monthly ## Hack23 ISMS Policy References - [Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) - [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) - [Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md) ## Compliance Mapping - **ISO 27001:2022**: A.8.8 (Technical Vulnerability Management) - **NIST CSF 2.0**: DE.CM-8 (Vulnerability Scans), ID.RA (Risk Assessment) - **CIS Controls v8.1**: Control 7 (Continuous Vulnerability Management) - **OWASP Top 10**: A06:2021 (Vulnerable and Outdated Components)