Manage fix prioritization policies
Role required: User ManagerThe Priority section within Policies allows you to configure your organization's decisions for prioritizing vulnerability remediation based on multiple criteria, most of which are based on the CVSS metrics.
Want to know the top ten security issues to prioritize for fixing?
- Across your groups: Open your To do section and switch to the Priority fixes tab.
- In your group: Click the Priority fixes button in Vulnerabilities.
Follow these steps to add a new prioritization policy:
- In the Priority section, click on Add criteria.
- Select a category corresponding to your criterion to prioritize a vulnerability.
- Choose a criterion from the selected category. The following example shows prioritization based on the Technique to discover the vulnerability (this is the only category which is not a metric in the CVSS).
- Enter a score between -1000 and 1000. This score will be added to the Priority score of every vulnerability that meets the selected criterion, thus helping your team prioritize the most important vulnerabilities to remediate according to your own context and knowledge.
- Click Confirm to add the policy.
Find the description of the metrics based on the CVSS in the official framework documentation.
Since we allow the entry of negative values, we then normalize them within a range of -3000 to 3000 so as not to show you priority scores with negative percentages.
If necessary, you can add further criteria within that category by clicking on the plus icon.
You can add as many policies as needed, which are then applied across every group in the organization.
Note: The Priority score column of the table in Vulnerabilities derives its value from these policies, but also the root's Priority, configured when you added the Git root. You can establish a root to be of Low, Medium, High, or Critical priority, which corresponds to 25, 50, 75, and 100 priority units, respectively. This means that if the root's Priority is marked as High, every vulnerability reported from that root will have an additional 75 units added to its corresponding Priority score. Bear in mind: The default value for the root's Priority is Low. In the case of the example in the steps above, every vulnerability that is detected through PTaaS will be added 100 units to their Priority score. Other variables contributing to the Priority score are individual vulnerability priority given when assigning treatments and a default value derived from the CVSS score, which is calculated with this formula: (4^(CVSS-4)) / 4.096.
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.