Skip to main content
CVE analysis and the ISMS are included from Business on.
We handle a critical vulnerability from detection to closure: prioritize in CVE Analysis, check the affected systems, assign a person, create a control in the ISMS, track implementation and close the CVE. Prerequisite: scanned systems with captured software, and write access in the Analysis and ISMS areas. Matching against known vulnerabilities runs in the background.

​
Starting point

Docusnap Sports GmbH has finished scanning the Windows servers. Under Analysis › CVE Analysis, the list By CVEs shows at the top a CVE with CVSS 9.8 (version 3.1) and severity Critical. Affected: the web frontend of the ERP system.

​
1. Prioritize

The list By CVEs is sorted by CVSS descending. The most dangerous vulnerability is at the top. We open it via the column CVE ID.
Analysis › Dashboard shows the number under Critical CVEs and leads directly into this list.
The Overview tab shows the CVSS value, the severity and the metrics of the rating. Below the value stand the version and the vector of the rating. On the Assessment tab, the section General holds the Remediation Deadline. It follows from the CVSS value: at 9.8 it is 7 days.

​
2. Check affected systems

The tab Affected Assets lists the systems, the tab Affected Software the installations with version and host. Here: the web frontend, one installation.
Affected Assets counts systems, Affected Software installations. A system with two affected installations appears once under Affected Assets and twice under Affected Software.

​
3. Assign and rate

Tab Assessment, pencil icon. In the Risk Assessment section we rate the CVE in the risk matrix. For a CVE that has not been rated yet, the matrix appears only in edit mode. Save.
Cancel or switching tabs asks for confirmation before the input is discarded.
Accepted and False Positive require a Reason. An accepted CVE stays documented without a control.

​
4. Create the control

Tab Controls, button Control, in the Add Control dialog the path Create New. In the Create Control dialog: Create. The control is linked to the CVE and also appears under ISMS › Risk Management › Controls.
The Controls tab on the CVE is a view of the ISMS controls, not a separate management. The same control can treat a CVE and fulfil a regulation objective.

​
5. Track implementation

Under ISMS › Risk Management › Controls the administrator sets the status to In progress and, after the update, to Implemented. The CVE’s Controls tab shows the progress: one of one control implemented.

​
6. Close the CVE

Tab Assessment: Status Resolved. With Resolved, the Open CVEs list on the asset hides the CVE. The matching does not change a status that has been set. Once the software is updated, the next scan removes the link between the CVE and the asset. The Journal keeps this traceable.
If remediation is not yet possible, the status stays In Progress with a new Due Date. The Remediation Deadline does not change—it is the default from the severity, Due Date our agreement.

​
Result

  • The critical CVE has a responsible person, a due date and a status.
  • A control in the ISMS documents the remediation.
  • The path from vulnerability to implementation is traceable—on the CVE and on the control.
All statuses, deadlines and tabs: CVE Analysis. Controls in the ISMS: Manage Controls.