Skip to main content

Internal Processes for Assessing and Prioritizing Reported Software Vulnerabilities

So, your vulnerability reporting channels are open, and a report about a potential weakness in your app or game lands in your inbox. What now? The Cyber Resilience Act (CRA) implies you need robust internal processes to handle these. A key part of "address and remediate vulnerabilities without delay" (Annex I, Part II, point (2)) is first understanding what you're dealing with.

Initial Triage and Assessment​

When a vulnerability is reported for your software:

  1. Acknowledge Receipt: Let the reporter know you've received their information.
  2. Validate the Vulnerability: Can your team reproduce the issue based on the information provided? Is it a genuine security flaw, a bug, or a misunderstanding?
  3. Assess Severity and Impact: This is crucial for prioritization.
    • How easy is it to exploit?
    • What is the potential damage if exploited (e.g., data theft from your app, cheating in your game, denial of service)?
    • How many users or systems could be affected? You might use a common scoring system like CVSS (Common Vulnerability Scoring System) as a guide, or a simpler High/Medium/Low rating tailored to your product.

Prioritization is Key​

Not all vulnerabilities are created equal. You likely can't fix everything instantly, especially in complex software like game engines or feature-rich apps. Prioritize based on:

  • Severity/Impact Assessment: Critical and high-severity vulnerabilities jump to the front of the queue.
  • Exploitability: Is there known exploit code "in the wild"? Is it being actively exploited? (Article 14 kicks in for actively exploited ones).
  • Scope: Does it affect a core function of your app or game, or a minor, isolated feature?
  • User Base: Does it impact all users or a small subset?

Document your assessment and prioritization decisions. This helps demonstrate a systematic approach to vulnerability management.

Key Takeway​

Once a vulnerability is reported for your software, you need internal processes to validate it, assess its severity and potential impact, and then prioritize remediation efforts. This structured approach is vital for timely and effective vulnerability handling under the CRA.