Skip to main content

Vulnerability Management Processes

Cloudaware provides a framework for organizing and prioritizing vulnerabilities discovered by external scanning tools and Cloudaware sources. The goal is to help security teams identify what needs immediate attention, control exceptions, and systematically reduce unresolved security debt.

info
  • Audience: SecOps, App/Infra Owners, Cloudaware administrators
  • Outcomes: Prioritized workstreams, accountable ownership, controlled suppression, and regular escalation cycles

Basic Vulnerability Management​

The process uses two core components — Initiatives and Remediation Tasks — that work together to drive down risk across the organization.

Initiatives​

  • Purpose: Large, organization‑wide efforts to reduce systemic risk; each initiative is measurable and can span multiple teams or environments.
  • Example: Migrate from an unsupported OS (e.g., CentOS 5) across all environments within a defined timeline.

Remediation Tasks​

  • Purpose: Actionable units of work assigned to specific teams or environments.
  • Generation: Tasks are created based on parameters such as vulnerability name, affected environment, and ownership.
  • Ownership: Defines accountability and enables tracking by the responsible team, application, or organizational unit (OU).
  • Tracking: Use CMDB fields and dashboards to monitor counts, age, SLAs, and completion rate.

Custom Vulnerability Management​

A flexible model built around three components — Exceptions, Remediation Tasks, and Escalation Reports — to enable suppression and structured remediation through CMDB and integrated ticketing (e.g., Jira).

Vulnerability Exceptions​

  • Purpose: Mark specific vulnerabilities as acceptable risks that do not require immediate remediation.
  • Implementation:
    • Represented by a custom CMDB object Vulnerability Exception with a lookup relationship to Vulnerability Scan records. See Exceptions.
    • Multiple scans can be linked to a single exception record.
    • Exceptions are created manually by customers.
    • Once created, the exception automatically appears on all related scans.
    • If a vulnerability has a linked exception that has not expired, the related Vulnerability Scan record automatically shows the Is Suppressed checkbox as checked. This flag is critical for downstream processes such as remediation routing and reporting.

Vulnerability Remediation Tasks​

  • Purpose: Provide structured tracking for vulnerabilities requiring action and integration with external ticketing systems.
  • Implementation:
    • Tasks are created automatically on the first working day of each month (currently, for CrowdStrike vulnerabilities only).
    • Naming convention: {Organization Unit}-{ExPRT Rating}-{Task Creation Date}
      • Example: SRE-CRITICAL-11/07/2024
    • Due Date: calculated as 90 days from creation using custom logic.
    • Each task automatically generates one Jira ticket containing the list of related vulnerabilities for that period and rating.

Escalation Reports​

  • Purpose: Provide regular oversight and accountability by surfacing vulnerability data to OUs.
  • Implementation:
    • Reports are defined by Organization Unit (OU) and Escalation Cycle parameters.
    • A UI view enables teams to review and mass‑update vulnerability data.
    • Cloudaware delivers these reports to OU teams via scheduled report subscriptions — typically every Wednesday — as part of an automation flow.

Prioritization and Ownership​

  • Prioritization signals: Combine CVSS/ExPRT ratings, exploitability, and business impact (criticality, data sensitivity) to focus effort where it matters most.
  • Ownership mapping: Align assets and findings to teams, applications, and OUs for clear accountability and reporting.

See also: Prioritization.

Exceptions, SLAs, and Reporting​

  • Exception policy: Govern creation, approval, and expiry of exceptions to prevent indefinite suppression.
  • SLAs: Define severity‑based due dates and target burn‑down goals by OU/app.
  • Dashboards & reports: Track scanning coverage, age, exception volume, SLA breaches, and monthly trend lines.

See also: Exceptions & SLAs and Dashboards & Reporting.

Automation and Integrations​

  • Ticketing: Sync tasks to Jira (stateful updates supported) and route by OU/ownership.
  • Sources: Consolidate cloud‑native signals and vendor scanners.
  • Remediation: Coordinate with Patch Management.