# Improving Vulnerability Management Through Process Mining
## 4 An Exemplary Use Case
### The Business Perspective
#### 4.4.1 Vulnerability Management Process  
The target vulnerability management process of the company has four phases: detection, analysis, remediation, and verification. It is therefore similar to the process described in Section 2. However, it skips the asset discovery, which was only carried out once when the process was introduced. In addition, the fourth step of remediation and verification is split into two separate steps. Figure 5 shows a high-level process model.  
In the detection phase, the company's systems are manually or automatically scanned for weaknesses. There are four sources scanning for vulnerabilities, which are explained in Table 2. All scans except for DefectDojo are unauthenticated scans.  
Figure 5: High-level view of the vulnerability management process.  
After detection, the findings are transferred into the internal vulnerability management (VM) system, ServiceNow, by a middleware. For each potential vulnerability, a vulnerable item (VI) is created with the details about the findings and the asset that it affects. For each VI, a vulnerability group (VUL) is created, which contains the priority according to the CVSS, the state, and the assignment group of the vulnerability. The state is set to \"New\", the assignment group to \"SEC.VUL\", which is the assignment group for the digital security team.  
In the next step, analysis, vulnerabilities are assessed, re-prioritized if necessary, and assigned to the responsible assignment group. In the assessment, potential vulnerabilities are checked for false positives. The state of those gets set to \"False Positive\", and the vulnerabilities will not be dealt with further. Next, the rest of the vulnerabilities are investigated to check if re-prioritization is necessary by defining the risk of the vulnerability for the company. Each priority is bound to a remediation target, which is a guideline of how fast it should be fixed:  
* Critical: 10 days;
* High: 30 days;
* Moderate (\"Medium\" in the standardized rating): 120 days;
* Low: no target.  
After prioritization, the vulnerabilities get assigned to an assignment group. This is dependent on the asset that the vulnerability affects. There are currently 25 assignment groups defined. After assignment, the vulnerability's state is set to \"Assigned\".  
The entire analysis phase is performed by the digital security team. There is currently no automation.  
After assignment, the remediation step starts. In this step, the assignment group tries to fix the vulnerability in the set time. Once fixed, the vulnerability gets set to \"Resolved\". If the vulnerability cannot be fixed, the assignment group can try to defer the remediation. For low and moderate vulnerabilities, this is possible just by changing the state to \"Defer\". For high and critical vulnerabilities, the assignment group can set the state to \"In Review\". The digital security team can then approve or decline the deferral by setting it back to \"Assigned\" or setting it to \"Defer\". If a vulnerability gets set to \"Defer\", a deferral date is set, with a maximum of one year. After that date, the vulnerability gets set back to \"Assigned\" and the assignment group must re-evaluate if remediation is possible. If not, the state can be set back to \"Defer\" or \"In Review\".  
The last step of the VM process is verification. Resolved vulnerabilities get tested if they still exist. This either happens automatically by the same scanner that detected the vulnerability or manually by the digital security team. If the test concludes that the vulnerability is resolved, the state gets set to \"Closed\".