Exception Management
To define a systematic approach for managing and documenting exceptions to identified vulnerabilities that deviate from established remediation protocols.
Key Elements of a Vulnerability Exception:
- Exception Name: A descriptive title summarizing the exception.
- Description: A detailed explanation of the exception, including its scope and impact.
- Identifiers
- Asset IDs: Identifies the resources impacted by this exception. Use * for wildcard.
- Vulnerability IDs: Specific vulnerabilities covered by this exception. Use * for wildcard.
- Zone IDs: Resource zones impacted. Use * for wildcard.
- Risk Scoring
- Turbine Risk Score Range: Defines the range of scores for the vulnerabilities affected. Use -1 for wildcards.
- Minimum: 0
- Maximum: 1000
- CVSS Base Score Range: Minimum and Maximum CVSS Scores for covered vulnerabilities, using -1 for wildcards.
- Ownership: The individual responsible for the exception, including contact information.
- Expiration: Defines a clear timeline for the exception, including an expiration date
- Reason: Documented rationale for granting the exception (for example, operational necessity, low risk, and so on).
- Status: Tracks the current state of the exception (Active/Inactive).
All of the above field are REQUIRED in order to create an exception. Exceptions are evaluated whenever a finding is ingested into the Turbine platform, or when re-enrichment is triggered from the Vulnerability Finding application.
