Vulnerability Scanning

Network Scanning:
  └─ Finds: Open ports, running services, outdated protocols
  └─ Tools: Nessus, Qualys, OpenVAS, nmap
  └─ Frequency: Weekly for critical, monthly for standard

Application Scanning (DAST):
  └─ Finds: SQLi, XSS, CSRF, authentication flaws
  └─ Tools: OWASP ZAP, Burp Suite, Acunetix
  └─ Frequency: Every build in CI/CD + quarterly full scan

Container Scanning:
  └─ Finds: Vulnerable base images, malware in images
  └─ Tools: Trivy, Clair, Snyk, Docker Scout
  └─ Frequency: Every image build, before deployment

Base Score Metrics:
  └─ Attack Vector (AV): Network, Adjacent, Local, Physical
  └─ Attack Complexity (AC): Low, High
  └─ Privileges Required (PR): None, Low, High
  └─ User Interaction (UI): None, Required
  └─ Scope (S): Unchanged, Changed
  └─ Confidentiality (C): High, Low, None
  └─ Integrity (I): High, Low, None
  └─ Availability (A): High, Low, None

Score Ranges:
  └─ 0.0: None
  └─ 0.1-3.9: Low
  └─ 4.0-6.9: Medium
  └─ 7.0-8.9: High
  └─ 9.0-10.0: Critical

Attack Vector: Network (0.85)
Attack Complexity: Low (0.77)
Privileges Required: None (0.85)
User Interaction: None (0.85)
Scope: Changed (1.0)
Confidentiality: High (0.56)
Integrity: High (0.56)
Availability: High (0.56)

Base Score: 10.0 (CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Recommended Scan Frequency:

High-Risk Assets (Internet-facing, PII, critical infrastructure):
  └─ External scan: Weekly
  └─ Internal scan: Weekly
  └─ Container scan: Every build
  └─ Web app DAST: Every deployment
  └─ Configuration scan: Continuous (CSPM)

Medium-Risk Assets (Internal systems, non-PII):
  └─ External scan: Monthly
  └─ Internal scan: Monthly
  └─ Container scan: Weekly
  └─ Web app DAST: Monthly

Low-Risk Assets (Development, test, isolated):
  └─ External scan: Quarterly
  └─ Internal scan: Quarterly
  └─ Container scan: Per release
  └─ Web app DAST: Per release

False Positive Sources:
  └─ Scanner misidentifies service version (banner grabbing inaccuracies)
  └─ Vulnerability present but not exploitable in context
  └─ Compensating control mitigates the risk (e.g., WAF blocks SQLi)
  └─ Scanner lacks context (e.g., reports missing patch but server is container)

FP Handling Process:
  1. Scan runs → vulnerability reported
  2. Analyst reviews finding + context
  3. Determines: True positive, False positive, or Accepted risk
  4. Document decision in ticketing system
  5. Update scanner with exception (if applicable)
  6. Re-verify on next scan cycle

FP Rate Targets:
  └─ Initial scan: 30-50% false positive rate (expected)
  └─ After 3 months tuning: < 15% false positive rate
  └─ Mature program: < 10% false positive rate

Commit Stage (per commit, <5 minutes):
  └─ IaC scanning: Checkov scans Terraform/CloudFormation for misconfigurations
  └─ Container base image scan: Trivy scans Dockerfile FROM image
  └─ Dependency scan: Snyk/Grype scans package.json, requirements.txt, pom.xml
  └─ SAST: Semgrep scans source code for vulnerabilities

Build Stage (per build, <10 minutes):
  └─ Container image scan: Trivy/Grype scans the built container
  └─ SBOM generation: Syft generates CycloneDX SBOM
  └─ Secret scan: TruffleHog/Gitleaks scans for hardcoded secrets

Deploy Stage (per deployment):
  └─ DAST: OWASP ZAP scans the deployed staging environment
  └─ Compliance scan: InSpec/Chef Compliance checks against CIS benchmarks
  └─ External scan: Temporary cloud-based scanner tests from external perspective

Production (continuous):
  └─ Feed scan results to SIEM for correlation with other events
  └─ Monitor for new CVEs affecting deployed software versions (SCA continuous monitor)
  └─ Agent-based scanning (CSPM agents on cloud workloads)

vulnerability-scan:
  stage: test
  script:
    # Container scan with Trivy
    - trivy image --severity CRITICAL,HIGH --exit-code 1 $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

    # Dependency scan with Grype
    - grype dir:. --only-fixed --fail-on high

    # Generate SBOM
    - syft dir:. -o cyclonedx > sbom.cdx.json

  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
      dependency_scanning: gl-dependency-scanning-report.json

Tool        | Speed   | Depth   | Formats                     | Integrations
------------|---------|---------|-----------------------------|---------------------
Trivy       | Fastest | Good    | Container, FS, Repo, SBOM   | Docker, K8s, CI/CD
Grype       | Fast    | Good    | Container, FS, SBOM         | Docker, K8s, CI/CD
Clair       | Medium  | Good    | Container                   | Quay, CoreOS
Snyk        | Medium  | Best    | Container, FS, IaC, Code    | All major platforms
Anchore     | Medium  | Best    | Container, SBOM             | Docker, CI/CD
Docker Scout | Fast   | Good    | Container                   | Docker Hub, CLI

Key Metrics to Track:
  └─ Scan coverage: % of assets scanned in the last 30 days
      Target: > 95% of all assets
  └─ Mean time to scan: Time from scan trigger to results available
      Target: < 4 hours for standard scan, < 1 hour for critical
  └─ Vulnerability density: Findings per asset
      Target: < 10 critical/high per internet-facing asset
  └─ Recurring findings: Same vulnerability reappearing after "fix"
      Target: < 5% recurrence rate (indicates process failure)
  └─ Scanner health: % of scheduled scans that completed successfully
      Target: > 98% scan completion rate
  └─ False positive rate: % of findings marked as false positive
      Target: < 10% (mature program), < 20% (developing program)
  └─ Time to remediate: Mean time from finding to fix
      Target: Critical < 7 days, High < 30 days, Medium < 90 days