vulnerability-management

What this skill does

# Vulnerability Management

End-to-end vulnerability lifecycle from discovery through remediation and verification.

## When to Use This Skill

**Keywords:** vulnerability management, CVE, CVSS, remediation, patching, risk prioritization, EPSS, KEV, vulnerability disclosure, bug bounty, patch management, vulnerability scanning, asset inventory

**Use this skill when:**

- Setting up vulnerability management programs
- Interpreting CVSS scores and metrics
- Prioritizing vulnerability remediation
- Designing patch management processes
- Implementing vulnerability disclosure programs
- Managing bug bounty programs
- Tracking CVE/CWE/NVD data
- Creating SLA policies for remediation

## Quick Decision Tree

1. **Understanding vulnerability scores?** → See [CVSS Scoring](#cvss-scoring-overview)
2. **Prioritizing what to fix first?** → See [Risk-Based Prioritization](#risk-based-prioritization)
3. **Designing remediation workflow?** → See [references/remediation-workflow.md](references/remediation-workflow.md)
4. **Setting up disclosure program?** → See [Vulnerability Disclosure](#vulnerability-disclosure)
5. **CVSS calculation details?** → See [references/cvss-scoring.md](references/cvss-scoring.md)

## Vulnerability Lifecycle

```text
┌─────────────────────────────────────────────────────────────────┐
│               VULNERABILITY MANAGEMENT LIFECYCLE                 │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  DISCOVER ──▶ ASSESS ──▶ PRIORITIZE ──▶ REMEDIATE ──▶ VERIFY   │
│      │          │           │              │            │        │
│      ▼          ▼           ▼              ▼            ▼        │
│  ┌───────┐  ┌───────┐  ┌────────┐    ┌────────┐   ┌────────┐   │
│  │Scanner│  │CVSS   │  │Risk    │    │Patch/  │   │Rescan/ │   │
│  │Pentest│  │Context│  │Matrix  │    │Config  │   │Validate│   │
│  │Bug    │  │Assets │  │EPSS+KEV│    │Mitigate│   │Close   │   │
│  │Bounty │  │Impact │  │SLA     │    │Accept  │   │        │   │
│  └───────┘  └───────┘  └────────┘    └────────┘   └────────┘   │
│                                                                  │
│  CONTINUOUS: Monitor ◀──────────────────────────────────────────┤
│                                                                  │
└─────────────────────────────────────────────────────────────────┘
```

## CVSS Scoring Overview

Common Vulnerability Scoring System provides standardized severity ratings.

### CVSS v3.1 Score Ranges

| Score | Severity | Typical SLA |
|-------|----------|-------------|
| 9.0-10.0 | Critical | 24-72 hours |
| 7.0-8.9 | High | 7-14 days |
| 4.0-6.9 | Medium | 30-60 days |
| 0.1-3.9 | Low | 90-180 days |
| 0.0 | None | Risk acceptance |

### CVSS v3.1 Metric Groups

```csharp
public enum AttackVector { Network, Adjacent, Local, Physical }
public enum AttackComplexity { Low, High }
public enum PrivilegesRequired { None, Low, High }
public enum UserInteraction { None, Required }
public enum Scope { Unchanged, Changed }
public enum ImpactLevel { None, Low, High }

/// <summary>
/// CVSS v3.1 Base Score vector
/// </summary>
public sealed record CvssV31Vector(
    AttackVector AttackVector,
    AttackComplexity AttackComplexity,
    PrivilegesRequired PrivilegesRequired,
    UserInteraction UserInteraction,
    Scope Scope,
    ImpactLevel Confidentiality,
    ImpactLevel Integrity,
    ImpactLevel Availability)
{
    private static readonly FrozenDictionary<AttackVector, (string Code, double Value)> AvMetrics =
        new Dictionary<AttackVector, (string, double)>
        {
            [AttackVector.Network] = ("N", 0.85),
            [AttackVector.Adjacent] = ("A", 0.62),
            [AttackVector.Local] = ("L", 0.55),
            [AttackVector.Physical] = ("P", 0.20)
        }.ToFrozenDictionary();

    private static readonly FrozenDictionary<AttackComplexity, (string Code, double Value)> AcMetrics =
        new Dictionary<AttackComplexity, (string, double)>
        {
            [AttackComplexity.Low] = ("L", 0.77),
            [AttackComplexity.High] = ("H", 0.44)
        }.ToFrozenDictionary();

    private static readonly FrozenDictionary<ImpactLevel, (string Code, double Value)> ImpactMetrics =
        new Dictionary<ImpactLevel, (string, double)>
        {
            [ImpactLevel.None] = ("N", 0.00),
            [ImpactLevel.Low] = ("L", 0.22),
            [ImpactLevel.High] = ("H", 0.56)
        }.ToFrozenDictionary();

    public string ToVectorString() =>
        $"CVSS:3.1/AV:{AvMetrics[AttackVector].Code}/" +
        $"AC:{AcMetrics[AttackComplexity].Code}/" +
        $"PR:{GetPrCode()}/" +
        $"UI:{(UserInteraction == UserInteraction.None ? "N" : "R")}/" +
        $"S:{(Scope == Scope.Unchanged ? "U" : "C")}/" +
        $"C:{ImpactMetrics[Confidentiality].Code}/" +
        $"I:{ImpactMetrics[Integrity].Code}/" +
        $"A:{ImpactMetrics[Availability].Code}";

    public double CalculateBaseScore()
    {
        // Impact sub-score
        var iscBase = 1 - (
            (1 - ImpactMetrics[Confidentiality].Value) *
            (1 - ImpactMetrics[Integrity].Value) *
            (1 - ImpactMetrics[Availability].Value));

        var impact = Scope == Scope.Unchanged
            ? 6.42 * iscBase
            : 7.52 * (iscBase - 0.029) - 3.25 * Math.Pow(iscBase - 0.02, 15);

        // Exploitability sub-score
        var exploitability = 8.22 *
            AvMetrics[AttackVector].Value *
            AcMetrics[AttackComplexity].Value *
            GetPrValue() *
            (UserInteraction == UserInteraction.None ? 0.85 : 0.62);

        if (impact <= 0) return 0.0;

        var score = Scope == Scope.Unchanged
            ? Math.Min(impact + exploitability, 10)
            : Math.Min(1.08 * (impact + exploitability), 10);

        return Math.Round(score * 10) / 10; // Round to 1 decimal
    }

    private string GetPrCode() => PrivilegesRequired switch
    {
        PrivilegesRequired.None => "N",
        PrivilegesRequired.Low => "L",
        PrivilegesRequired.High => "H",
        _ => "N"
    };

    private double GetPrValue() => (PrivilegesRequired, Scope) switch
    {
        (PrivilegesRequired.None, _) => 0.85,
        (PrivilegesRequired.Low, Scope.Unchanged) => 0.62,
        (PrivilegesRequired.Low, Scope.Changed) => 0.68,
        (PrivilegesRequired.High, Scope.Unchanged) => 0.27,
        (PrivilegesRequired.High, Scope.Changed) => 0.50,
        _ => 0.85
    };
}

// Example: Log4Shell (CVE-2021-44228)
var log4shell = new CvssV31Vector(
    AttackVector: AttackVector.Network,
    AttackComplexity: AttackComplexity.Low,
    PrivilegesRequired: PrivilegesRequired.None,
    UserInteraction: UserInteraction.None,
    Scope: Scope.Changed,
    Confidentiality: ImpactLevel.High,
    Integrity: ImpactLevel.High,
    Availability: ImpactLevel.High);

Console.WriteLine($"Vector: {log4shell.ToVectorString()}");
Console.WriteLine($"Score: {log4shell.CalculateBaseScore()}"); // 10.0
```

**For detailed CVSS scoring including Temporal and Environmental metrics**, see [references/cvss-scoring.md](references/cvss-scoring.md).

## Risk-Based Prioritization

CVSS alone is insufficient for prioritization. Use multiple signals:

### Prioritization Framework

```csharp
using System.Collections.Frozen;

public enum AssetCriticality { Low, Medium, High, Critical }
public enum AssetExposure { Internal, Dmz, External }
public enum DataSensitivity { Public, Internal, Confidential, Restricted }
public enum ExploitMaturity { Unproven, Poc, Functional, High }

/// <summary>Complete context for vulnerability prioritization</summary>
public sealed record VulnerabilityContext(
    string CveId,
    double CvssBase,
    double? CvssEnvironmental = null,
    double? CvssTemporal = null,
    double EpssProbability = 0.0,      // 0-1 probability of exploitation
    double EpssPercentile = 0.0,       // Relative ranking
    bool InKev = false,
    DateTimeOffse