# Improving Vulnerability Management Through Process Mining
## 4 An Exemplary Use Case
### Evaluation
#### 4.8.2 Subgoal 2--Ensure Proper Remediation  
For this goal, we used the process mining approaches of process discovery and process conformance to compare the target process with the analyzed process. We utilized process discovery to discover a process model and manually inspect it for unwanted activities or flows. We applied process conformance to automatically compare a created target model with the discovered process model. As for process discovery and all discovered process models, we first examined the state process without filters, as seen in Figure 15. Here, it is noticeable that only the states \"New\", \"Assigned\", and \"Closed\" are among the most used activities. As seen in Figure 8, however, the target process flow through the states always includes the state \"Resolved\" before the state \"Closed\". Since the verification phase is happening between these two states, skipping the state \"Resolved\" might mean that the verification phase is often skipped. Using PQL, we calculated that 70% of cases get closed without ever being resolved. This poses a problem since, without verification, it is not possible to know if a closed vulnerability really does not exist any more. One improvement for this might be a stricter implementation of the process in SNOW to forbid skipping the state \"Resolved\". To check if this behavior has any specific root causes, a deeper analysis as that in Section 4.8.1 can be performed in Celonis. Looking at process flow 1 does not give more valuable insight into conformance with the target process. While there are slight deviations, such as the activity \"State: Assigned\"happening without a user ever being assigned, these deviations do not seem to have negative implications on the proper remediation of vulnerabilities. One deviation was cases that go from \"State: Closed\" back to another activity such as \"State: Assigned\". This was known already as described above. This deviation means that a vulnerability believed to be resolved and was verified to be resolved reappears. It also costs a large amount of time, as already explained above. We have also already mentioned above that this was mainly due to a misconfiguration of a source. Fixing this is not only relevant for making the process faster but also for making sure only vulnerabilities that were remediated properly get closed. Falsely closing vulnerabilities does not just pose the risk of a slower remediation of a vulnerability but also of a reduced visibility of the risks posed to the company. Further looking at the state process shows that the state \"Awaiting Implementation\" is hardly ever used. While not necessary in the target process, this state helps to show when a vulnerability is being taken care of. Enforcing the use of this state could help to further investigate the remediation phase. After this first overview, we used Celonis' conformance checker. The state process model as shown in Figure 8 is added as input. The output is  
1. The percentage of cases conforming to this target model per month;
2. The number of violations;
3. The throughput time for conforming vs. non-conforming cases;
4. A list of violations. Especially the first and fourth point are of interest for this business goal, while the third point is of interest to the first goal. It can be seen that the throughput time of the target process is, on average, 28 days less than for cases not following the target process. This can be interpreted as a sign that the target process is well defined. Focusing on the list of violations, it is shown exactly which undesired process flows happen in the process and the consequences of that. Part of this list can be seen in Figure 16. In about half of all cases, the state \"Assigned\" is followed by the state \"Closed\". This is one of the process flows in which the state \"Resolved\" is skipped, as already discussed above. The second violation on the list, \"New is followed by Closed\", also skips the state \"Resolved\".