A.8.8 Management of Technical Vulnerabilities
Control Objective
Information about technical vulnerabilities of information systems in use shall be obtained, the organisation’s exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.
Policy Statement
anDREa implements proactive vulnerability management practices to discover, assess, and remediate technical flaws within our source code, cloud infrastructure, and corporate endpoints. By combining automated continuous scanning, external threat intelligence feeds, and an aggressive Patch Management SLA, we minimize our operational exposure to potential exploits.
Patch Management SLA
To ensure timely mitigation, anDREa enforces a strict Service Level Agreement (SLA) for applying security patches across all organizational systems and endpoints:
| Vulnerability Severity | Remediation SLA Target | Enforcement Method |
|---|---|---|
| Critical & High | Within 72 hours of release or detection | Automated deployment / Immediate push |
| Medium | Within 7 days of release | Scheduled weekly policy push |
| Low | Within 30 days or next scheduled maintenance window | Standard cycle update |
- Automatic Enforcement: Where technically feasible (such as via Google Endpoint Management and Azure Update Management), security patches are pushed automatically to guarantee compliance with these windows.
- Infrastructure Exceptions: Virtual Machines (VMs) provisioned within research Workspaces are the explicit operational responsibility of their respective Accountable and Privileged Members. Relevant system updates for these VMs are made available upon system startup.
- Policy Deviations: Any variance from this SLA due to legacy software constraints or critical runtime incompatibilities must be logged in a dedicated ticket with an explicit business justification, subject to formal review and sign-off by the Security Officer.
See: Patching Performance
Vulnerability Intelligence and Discovery Channels
anDREa aggregates security intelligence from specialized ecosystems to maintain complete situational awareness:
1. Cloud Infrastructure & Platform (myDRE / Microsoft Azure)
- Independent Auditing: Mandatory Annual Penetration Testing executed by certified third-party security firms (see: Management Reports).
- Continuous Monitoring: Custom Azure Monitor Alerts configured to flag anomalous behavioral configurations or cloud perimeter exposure and Dependabot alerts (see: Unpatched items).
- External Intelligence: Active monitoring of the Nationaal Cyber Security Centrum (NCSC) RSS threat feeds (see: RSS Security), A51 Security daily intelligence newsletters, and industry reporting sources (e.g., BleepingComputer).
- Public Outreach: Crowd-sourced telemetry obtained via our public-facing Coordinated Vulnerability Discosure Policy workflow.
2. Software Development Pipeline (GitHub / CI-CD)
- Dependency Monitoring: GitHub Dependabot executes automated daily scans across all repositories to identify vulnerable package dependencies or outdated library inclusions.
- Static Application Security Testing (SAST): SonarCloud is embedded natively into the deployment pipeline, executing code quality and security vulnerability scans on a per-deployment basis before code hits production.
3. Corporate SaaS & Endpoints (Google Workspace)
- Threat Telemetry: Continuous visibility managed via the central Google Security Center dashboard.
- Threat Feeds: Supplemented with NCSC alerting integrations and user-submitted internal bug tracking (RSS Security).
Operational Execution and Handbooks
Vulnerabilities are systematically triaged, recorded, and remediated according to formalized operational books:
- The Red Book (Security & Crisis Response): Governs urgent zero-day exploits, critical incident response paths, and emergency patching coordination (see: Redbook).
- The Yellow Book (Bugs & Features): Coordinates standard software vulnerability patching, dependency deprecations, and code-level remediation.
- The Blue Book (Housekeeping): Outlines routine server maintenance, standard configuration adjustments, and low-priority software updates.