saolalab Vulnerability Management
Vulnerability Lifecycle
Discovery → Assessment → Prioritization → Remediation → Verification → Closure
CVSS Scoring Guide
Severity Levels
| CVSS Score | Severity | Remediation SLA |
|---|---|---|
| 9.0 - 10.0 | Critical | 24-72 hours |
| 7.0 - 8.9 | High | 7 days |
| 4.0 - 6.9 | Medium | 30 days |
| 0.1 - 3.9 | Low | 90 days |
Key CVSS Factors
- Attack Vector — Network, Adjacent, Local, Physical
- Attack Complexity — Low, High
- Privileges Required — None, Low, High
- User Interaction — None, Required
- Scope — Unchanged, Changed
- Impact — Confidentiality, Integrity, Availability
Vulnerability Report Template
## Vulnerability Report
### Summary
- **ID**: [CVE-XXXX-XXXXX or internal ID]
- **Title**: [Brief description]
- **Severity**: [Critical/High/Medium/Low]
- **CVSS**: [Score and vector]
- **Status**: [Open/In Progress/Remediated/Verified]
### Affected Assets
- [List affected systems, applications, versions]
### Technical Details
- **Vulnerability Type**: [SQLi, XSS, RCE, etc.]
- **Root Cause**: [Technical explanation]
- **Proof of Concept**: [Steps to reproduce]
### Impact Analysis
- **Confidentiality**: [Impact description]
- **Integrity**: [Impact description]
- **Availability**: [Impact description]
- **Business Impact**: [Business context]
### Remediation
- **Recommended Fix**: [Technical solution]
- **Workaround**: [Temporary mitigation if available]
- **Owner**: [Person responsible]
- **Due Date**: [Based on severity SLA]
### References
- [CVE link, vendor advisory, etc.]
Scanning Cadence
| Scan Type | Frequency | Scope |
|---|---|---|
| External | Weekly | Internet-facing assets |
| Internal | Bi-weekly | Internal network |
| Container | On build | All container images |
| Dependencies | On commit | All code repos |
| Web App | Monthly | Production apps |
Prioritization Matrix
Consider these factors beyond CVSS:
- Asset criticality — Crown jewels get higher priority
- Exposure — Internet-facing vs. internal
- Exploitability — Active exploitation in the wild
- Data sensitivity — PII, financial, health data
- Compensating controls — WAF, network segmentation
Metrics to Track
- Mean Time to Remediate (MTTR) — By severity
- Vulnerability Age — Days open by severity
- Open Vulnerability Count — Trend over time
- SLA Compliance — % remediated within SLA
- Recurrence Rate — Same vuln types reappearing