# Improving Vulnerability Management Through Process Mining
## 4 An Exemplary Use Case
### Evaluation
#### 4.8.1 Subgoal 1--Make the Process Faster  
For this goal, the two process mining approaches of process discovery and process enhancement were used. Process discovery was used to find the as-is process model that can be used for the first analysis by checking for loops or unusual patterns. It can then be used for process enhancement, firstly, to check the throughput time of the process to see where time is lost, and, secondly, to filter the process by priority, source, system, and assignment group. Figure 11: Discovered process model for process flow 1. Figure 12: Discovered process model for process flow 1 with all activities and transitions. As a first step, we looked at the discovered process model of process flow 2 as seen in Figure 13. This gives the best overview of the high-level process. Looking at the average throughput time between process steps, it can be clearly seen that most time is lost in the remediation phase between the activities \"Assigned\" and \"Resolved\". Using this information as a starting point, a deep dive was made into this phase. First, the data were filtered by priority, revealing that critical vulnerabilities get remediated faster, as intended. However, while the intended remediation target is ten days, the process model shows an actual remediation time of 42 days. Next, we analyzed the remediation phase by source. We created a table that shows which source takes longest in the remediation phase. As depicted in Table 8, that source is Qualys, with an average throughput time of 156 days between the first occurrence of the activity \"Assigned\" and the last occurrence of the activity \"Resolved\". Using this information, we looked at the process model for Qualys cases only. The process model of process flow 2 shows that the majority of Qualys cases get deferred, which, on average, adds 98 days to the throughput time. This is mainly the case for low and moderate vulnerabilities. To further analyze this, we took a closer look at the deferral process. This is described below. When filtering for critical vulnerabilities, it can be seen that the high remediation time is due to two loops in the process flow as presented in Figure 14. Firstly, some vulnerabilities directly go from \"Assigned\" to \"Closed\", then back to \"Assigned\" at least once before they finally get resolved and closed for good. Secondly, some vulnerabilities go from \"Assigned\" to \"Resolved\" and back to \"Assigned\" at least once. Both of these loops add around 30-110 days to the remediation phase. To get to the bottom of this behavior, we analyzed the assignment groups. We discovered that the first loop, i.e., closing the vulnerability from the \"Assigned\" state, is not performed by an assignment group but by Qualys itself via the middleware. With this information, we checked the configuration of the scanner and discovered that it regularly falsely classifies vulnerabilities as closed. With this fixed, we used the time vulnerabilities falsely spent in state \"Closed\" to remediate it, making the remediation process faster. The behavior seen in the second loop usually means that a vulnerability has been resolved by the assignment group. However, in the verification phase, we discovered that the vulnerability still exists. Taking a closer look at this over all  
Figure 13: Discovered process model for process flow 2 (filtered to include the activity “Resolved”). sources and priorities, we found that this mainly affects vulnerabilities from the sources Offensity, Qualys, or Prisma. A hypothesis is that these are automatic scans with automatically provided remediation instructions. These might not be as easy to follow as the manually written instructions by the other sources. This information could be a starting point for discussing improvement ideas such as better training for the assignment groups or enriching the remediation instructions provided by the automatic scanners.