1. Documentation
    2. history bug_report picture_as_pdf
×

Vulnerability management

Vulnerability management process

Vulnerability management is a continuous process to identify and remediate vulnerabilities. Red Hat Advanced Cluster Security for Kubernetes helps you to facilitate a vulnerability management process.

A successful vulnerability management program often includes the following critical tasks:

  • Performing asset assessment

  • Prioritizing the vulnerabilities

  • Assessing the exposure

  • Taking action

  • Continuously reassessing assets

Red Hat Advanced Cluster Security for Kubernetes helps organizations to perform continuous assessments on their OpenShift Container Platform and Kubernetes clusters. It provides organizations with the contextual information they need to prioritize and act on vulnerabilities in their environment more effectively.

Performing asset assessment

Performing an assessment of an organization’s assets involve the following actions:

  • Identifying the assets in your environment

  • Scanning these assets to identify known vulnerabilities

  • Reporting on the vulnerabilities in your environment to impacted stakeholders

When you install Red Hat Advanced Cluster Security for Kubernetes on your Kubernetes or OpenShift Container Platform cluster, it first aggregates the assets running inside of your cluster to help you identify those assets. RHACS allows organizations to perform continuous assessments on their OpenShift Container Platform and Kubernetes clusters. RHACS provides organizations with the contextual information to prioritize and act on vulnerabilities in their environment more effectively.

Important assets that should be monitored by the organization’s vulnerability management process using RHACS include:

  • Components: Components are software packages that may be used as part of an image or run on a node. Components are the lowest level where vulnerabilities are present. Therefore, organizations must upgrade, modify or remove software components in some way to remediate vulnerabilities.

  • Image: A collection of software components and code that create an environment to run an executable portion of code. Images are where you upgrade components to fix vulnerabilities.

  • Nodes: A server used to manage and run applications using OpenShift or Kubernetes and the components that make up the OpenShift Container Platform or Kubernetes service.

Red Hat Advanced Cluster Security for Kubernetes groups these assets into the following structures:

  • Deployment: A definition of an application in Kubernetes that may run pods with containers based on one or many images.

  • Namespace: A grouping of resources such as Deployments that support and isolate an application.

  • Cluster: A group of nodes used to run applications using OpenShift or Kubernetes.

Red Hat Advanced Cluster Security for Kubernetes scans the assets for known vulnerabilities and uses the Common Vulnerabilities and Exposures (CVE) data to assess the impact of a known vulnerability.

Viewing vulnerabilities

RHACS provides the following methods to view vulnerabilities discovered in your system:

  • To view application vulnerabilities by namespace or deployment, or to view vulnerabilities in an image, in the RHACS web portal, go to Vulnerability Management (1.0) → Dashboard.

  • To view vulnerabilities in applications running on clusters in your system, go to Vulnerability Management (2.0) → Workload CVEs. You can filter vulnerabilities by image, deployment, namespace, and cluster.

Viewing application vulnerabilities

You can view application vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes.

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Application & Infrastructure → Namespaces or Deployments.

  3. From the list, search for and select the Namespace or Deployment you want to review.

  4. To get more information about the application, select an entity from Related entities on the right.

Viewing image vulnerabilities

You can view image vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes.

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Images.

  3. From the list of images, select the image you want to investigate. You can also filter the list by performing one of the following steps:

    1. Enter Image in the search bar and then select the Image attribute.

    2. Enter the image name in the search bar.

  4. In the image details view, review the listed CVEs and prioritize taking action to address the impacted components.

  5. Select Components from Related entities on the right to get more information about all the components that are impacted by the selected image. Or select Components from the Affected components column under the Image findings section for a list of components affected by specific CVEs.

Additional resources

Viewing workload CVEs in Vulnerability Management (2.0)

You can view a comprehensive list of vulnerabilities, or CVEs, in RHACS across images and deployments. You can use the search filter bar to select specific CVEs, images, deployments, namespaces, or clusters.

Procedure

  1. In the RHACS portal, go to Vulnerability Management (2.0) → Workload CVEs.

  2. From the drop-down list, select the search criteria you want to use. You can select an item type, such as a cluster, from the list, and then select the specific name of the item. You can add additional items to the filter by selecting another item from the list and selecting the specific name of the new item. For example, you can select a specific image and a specific cluster to limit results to those selections. You can filter on the following items:

    • CVE

    • Image

    • Deployment

    • Namespace

    • Cluster

    • Component

    • Component source

  3. Optional: Use the CVE severity list to select the severities of the CVEs that you want to display.

  4. Click the relevant button to view a list of vulnerabilities, images, or deployments in the system.

    The Filtered view icon indicates that the displayed results were filtered based on the criteria that you selected. You can click Clear filters to remove all filters, or remove individual filters by clicking on them.

  5. In the list of results, click a CVE, image name, or deployment name to view more information about the item. For example, depending on the item type, you can view the following information:

    • Whether a CVE is fixable

    • Whether an image is active

    • The Dockerfile line in the image that contains the CVE

    • External links to information about the CVE in Red Hat and other CVE databases

Search example

The following graphic shows an example of search criteria for a cluster called "production" to view CVEs of critical and important severity in that cluster.

Workload CVE showing a search on the production cluster for CVEs with critical and important severity

Viewing infrastructure vulnerabilities

You can view vulnerabilities in nodes by using Red Hat Advanced Cluster Security for Kubernetes.

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Application & Infrastructure → Cluster.

  3. From the list of clusters, select the cluster you want to investigate.

  4. Review the clusters vulnerabilities and prioritize taking action on the impacted nodes on the cluster.

Viewing node vulnerabilities

You can view vulnerabilities in specific nodes by using Red Hat Advanced Cluster Security for Kubernetes.

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Nodes.

  3. From the list of nodes, select the node you want to investigate.

  4. Review vulnerabilities for the selected node and prioritize taking action.

  5. To get more information about the affected components in a node, select Components from Related entities on the right.

Prioritizing the vulnerabilities

Answer the following questions to prioritize the vulnerabilities in your environment for action and investigation:

  • How important is an affected asset for your organization?

  • How severe does a vulnerability need to be for investigation?

  • Can the vulnerability be fixed by a patch for the affected software component?

  • Does the existence of the vulnerability violate any of your organization’s security policies?

The answers to these questions help security and development teams decide if they want to gauge the exposure of a vulnerability.

Red Hat Advanced Cluster Security for Kubernetes provides you the means to facilitate the prioritization of the vulnerabilities in your applications and components.

Assessing the exposure

To assess your exposure to a vulnerability, answer the following questions:

  • Is your application impacted by a vulnerability?

  • Is the vulnerability mitigated by some other factor?

  • Are there any known threats that could lead to the exploitation of this vulnerability?

  • Are you using the software package which has the vulnerability?

  • Is spending time on a specific vulnerability and the software package worth it?

Take some of the following actions based on your assessment:

  • Consider marking the vulnerability as a false positive if you determine that there is no exposure or that the vulnerability does not apply in your environment.

  • Consider if you would prefer to remediate, mitigate or accept the risk if you are exposed.

  • Consider if you want to remove or change the software package to reduce your attack surface.

Taking action

Once you have decided to take action on a vulnerability, you can take one of the following actions:

  • Remediate the vulnerability

  • Mitigate and accept the risk

  • Accept the risk

  • Mark the vulnerability as a false positive

You can remediate vulnerabilities by performing one of the following actions:

  • Remove a software package

  • Update a software package to a non-vulnerable version.

Additional resources

Finding a new component version

The following procedure finds a new component version to upgrade to.

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Images.

  3. From the list of images, select the image you already assessed.

  4. Under the Image findings section, select the CVE.

  5. Select the affected components of the CVE you want to take action on.

  6. Review the version of the component that the CVE is fixed in and update your image.

Accepting risks

Follow the instructions in this section to accept the risks in Red Hat Advanced Cluster Security for Kubernetes.

Prerequisites

  • You must have write permission for the VulnerabilityManagementRequests resource.

To accept risk with or without mitigation:

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Images.

  3. From the list of images, select the image you already assessed.

  4. Find the row which lists the CVE you would like to take action on.

  5. Click the overflow menu, kebab, for the CVE you identified.

  6. Click Defer CVE.

  7. Select the date and time till you want to defer the CVE.

  8. Select if you want to defer the CVE for the selected image tag or all tags for this image.

  9. Enter the reason for the deferral.

  10. Click Request approval. Select the blue information icon on the right of the CVE and copy the approval link to share with your organization’s deferral approver.

Marking vulnerabilities as false positive

The following procedure marks a vulnerability as a false positive.

Prerequisites

  • You must have the write permission for the VulnerabilityManagementRequests resource.

Procedure

  1. In the RHACS portal, go to Vulnerability Management 1.0 → Dashboard.

  2. On the Dashboard view header, select Images.

  3. From the list of images, select the image you already assessed.

  4. Find the row which lists the CVE you would like to take action on.

  5. Click the kebab on the right for the CVE you identified and click Defer CVE.

  6. Select the date and time you want to defer the CVE.

  7. Select if you want to defer the CVE for the selected image tag or all tags for this image.

  8. Enter the reason for the deferral.

  9. Click Request approval.

  10. Select the blue information icon on the right of the CVE and copy the approval link to share with your organization’s deferral approver.

Reviewing a false positive or deferred CVE

Use the following procedure to review a false positive or deferred CVE.

Prerequisites

  • You must have the write permission for the VulnerabilityManagementApprovals resource.

You can review a false positive or deferred CVE:

Procedure

  1. Open the approval link in your browser or in the RHACS portal.

  2. Go to Vulnerability Management → Risk Acceptance and search for the CVE.

  3. Review the vulnerabilities scope and action to decide if you would like to approve it.

  4. Click on the kebab at the far right of the CVE and approve or deny the request for approval.

Reporting vulnerabilities to teams

As organizations must constantly reassess and report on their vulnerabilities, some organizations find it helpful to have scheduled communications to key stakeholders to help in the vulnerability management process.

You can use Red Hat Advanced Cluster Security for Kubernetes to schedule these reoccurring communications through e-mail. These communications should be scoped to the most relevant information that the key stakeholders need.

For sending these communications, you must consider the following questions:

  • What schedule would have the most impact when communicating with the stakeholders?

  • Who is the audience?

  • Should you only send specific severity vulnerabilities in your report?

  • Should you only send fixable vulnerabilities in your report?

Vulnerability reporting

You can create and download an on-demand image vulnerability report from the Vulnerability Management (2.0) menu in the RHACS web portal. This report includes a comprehensive list of common vulnerabilities and exposures across images and deployments, called workload CVEs in RHACS. You can share this report with auditors or internal stakeholders by scheduling emails in RHACS or by downloading the report and sharing it by using other methods.

Creating vulnerability management report configurations

RHACS guides you through the process of creating a vulnerability management report configuration. This configuration determines the information that will be included in a report job that runs at a scheduled time or that you run on demand.

Procedure

  1. In the RHACS portal, go to Vulnerability Management (2.0) → Vulnerability Reporting.

  2. Click Create report.

  3. Enter a name for your report configuration in the Report name field.

  4. Optional: Enter text describing the report configuration in the Description field.

  5. In the CVE severity field, select the severity of common vulnerabilities and exposures (CVEs) that you want to include in the report configuration.

  6. Select the CVE status. You can select Fixable, Unfixable, or both.

  7. In the Image type field, select whether you want to include CVEs from deployed images, watched images, or both.

  8. In the CVEs discovered since field, select the time period for which you want CVEs to be included in the report configuration.

  9. In the Configure report scope field, you can perform the following actions:

    • Select an existing collection and click View to view the collection information, edit the collection, and get a preview of collection results. When viewing the collection, entering text in the field searches for collections matching that text string.

    • Click Create collection to create a new collection.

      For more information about collections, see "Creating and using deployment collections" in the "Additional resources" section.

  10. Click Next to configure the delivery destinations and optionally set up a schedule for delivery.

Configuring delivery destinations and scheduling

Configuring destinations and delivery schedules for vulnerability reports is optional, unless on the previous page, you selected the option to include CVEs that were discovered since the last scheduled report. If you selected that option, configuring destinations and delivery schedules for vulnerability reports is required.

Procedure

  1. To configure destinations for delivery, in the Configure delivery destinations section, you can add a delivery destination and set up a schedule for reporting.

  2. To email reports, you must configure at least one email notifier. Select an existing notifier or create a new email notifier to send your report by email. For more information about creating an email notifier, see "Configuring the email plugin" in the "Additional resources" section.

    When you select a notifier, the email addresses configured in the notifier as Default recipients appear in the Distribution list field. You can add additional email addresses that are separated by a comma.

  3. A default email template is automatically applied. To edit this default template, perform the following steps:

    1. Click the edit icon and enter a customized subject and email body in the Edit tab.

    2. Click the Preview tab to see your proposed template.

    3. Click Apply to save your changes to the template.

      When reviewing the report jobs for a specific report, you can see whether the default template or a customized template was used when creating the report.

  4. In the Configure schedule section, select the frequency and day of the week for the report.

  5. Click Next to review your vulnerability report configuration and finish creating it.

Reviewing and creating the report configuration

You can review the details of your vulnerability report configuration before creating it.

Procedure

  1. In the Review and create section, you can review the report configuration parameters, delivery destination, email template that is used if you selected email delivery, delivery schedule, and report format. To make any changes, click Back to go to the previous section and edit the fields that you want to change.

  2. Click Create to create the report configuration and save it.

Vulnerability report permissions

The ability to create, view, and download reports depends on the access control settings, or roles and permission sets, for your user account.

For example, you can only view, create, and download reports for data that your user account has permission to access. In addition, the following restrictions apply:

  • You can only download reports that you have generated; you cannot download reports generated by other users.

  • Report permissions are restricted depending on the access settings for user accounts. If the access settings for your account change, old reports do not reflect the change. For example, if you are given new permissions and want to view vulnerability data that is now allowed by those permissions, you must create a new vulnerability report.

Editing vulnerability report configurations

You can edit existing vulnerability report configurations from the list of report configurations, or by selecting an individual report configuration first.

Procedure

  1. To edit an existing vulnerability report configuration, in the RHACS web portal, go to Vulnerability Management (2.0) → Vulnerability Reporting and choose one of the following methods:

    • Locate the report configuration that you want to edit in the list of report configurations. Click the overflow menu, kebab, and then select Edit report.

    • Click the report configuration name in the list of report configurations. Then, click Actions and select Edit report.

  2. Make changes to the report configuration and save.

Downloading vulnerability reports

You can generate an on-demand vulnerability report and then download it.

You can only download reports that you have generated; you cannot download reports generated by other users.
Procedure

  1. In the RHACS web portal, go to Vulnerability Management (2.0) → Vulnerability Reporting and, in the list of report configurations, locate the report configuration that you want to use to create the downloadable report.

  2. Generate the vulnerability report by using one of the following methods:

    • To generate the report from the list:

      1. Click the overflow menu, kebab, and then select Generate download. The My active job status column displays the status of your report creation. After the Processing status goes away, you can download the report.

    • To generate the report from the report window:

      1. Click the report configuration name to open the configuration detail window.

      2. Click Actions and select Generate download.

  3. To download the report, if you are viewing the list of report configurations, click the report configuration name to open it.

  4. Click All report jobs.

  5. If the report is completed, click the Ready for download link in the Status column. The report is in .csv format and is compressed into a .zip file for download.

Sending vulnerability reports on-demand

You can send vulnerability reports immediately, rather than waiting for the scheduled send time.

Procedure

  1. In the RHACS web portal, go to Vulnerability Management (2.0) → Vulnerability Reporting and, in the list of report configurations, locate the report configuration for the report that you want to send.

  2. Click the overflow menu, kebab, and then select Send report now.

Cloning vulnerability report configurations

You can make copies of vulnerability report configurations by cloning them. This is useful when you want to reuse report configurations with minor changes, such as reporting vulnerabilities in different deployments or namespaces.

Procedure

  1. In the RHACS web portal, go to Vulnerability Management (2.0) → Vulnerability Reporting and locate the report configuration that you want to clone in the list of report configurations.

  2. Click Clone report.

  3. Make any changes that you want to the report parameters and delivery destinations.

  4. Click Create.

Deleting vulnerability report configurations

Deleting a report configuration deletes the configuration and any reports that were previously run using this configuration.

Procedure

  1. In the RHACS web portal, go to Vulnerability Management (2.0) → Vulnerability Reporting and locate the report configuration that you want to delete in the list of reports.

  2. Click the overflow menu, kebab, and then select Delete report.

Configuring vulnerability management report job retention settings

You can configure settings that determine when vulnerability report job requests expire and other retention settings for report jobs.

These settings do not affect the following vulnerability report jobs:

  • Jobs in the WAITING or PREPARING state (unfinished jobs)

  • The last successful scheduled report job

  • The last successful on-demand emailed report job

  • The last successful downloadable report job

  • Downloadable report jobs for which the report file has not been deleted by either manual deletion or by configuring the downloadable report pruning settings
Procedure

  1. In the RHACS web portal, go to Platform Configuration → System Configuration. You can configure the following settings for vulnerability report jobs:

    • Vulnerability report run history retention: The number of days that a record is kept of vulnerability report jobs that have been run. This setting controls how many days that report jobs are listed in the All report jobs tab under Vulnerability Management (2.0) → Vulnerability Reporting when a report configuration is selected. All report history beyond the cutoff date is pruned except for the following jobs:

      • Unfinished jobs.

      • Jobs for which prepared downloadable reports still exist in the system.

      • The last successful report job for each job type (scheduled email, on-demand email, or download). This ensures users have information about the last run job for each type.

    • Prepared downloadable vulnerability reports retention days: The number of days that created on-demand downloadable vulnerability report jobs are available for download in the All report jobs tab under Vulnerability Management (2.0) → Vulnerability Reporting when a report configuration is selected.

    • Prepared downloadable vulnerability reports limit: The limit, in MB, of space allocated to prepared downloadable vulnerability report jobs. After the limit is reached, the oldest report job in the download queue is removed.

  2. To change these values, click Edit, make your changes, and then click Save.

Migration of vulnerability reports when upgrading to RHACS version 4.3 and later

Red Hat Advanced Cluster Security for Kubernetes (RHACS) version 4.3 includes an automatic migration of vulnerability report configurations that were created in previous versions of RHACS in the Vulnerability Management 1.0 → Reporting page. You can access migrated report configurations by clicking Vulnerability Management (2.0) → Vulnerability Reporting. The previous versions of the report configurations are no longer available in the RHACS web portal or by using the API.

RHACS performs the following actions during the migration:

  • Report configurations are copied to create a new version of the report that you can access by clicking Vulnerability Management (2.0) → Vulnerability Reporting.

  • The original name for the report is used when migrating reports to the new location.

  • Report configurations created in the Vulnerability Management 2.0 (Tech preview) → Reporting page are not affected by upgrading to RHACS version 4.3 or later. The menu item to access these report configurations was renamed Vulnerability Management (2.0) and the page was renamed Vulnerability Reporting.

  • If a report configuration previously created by using the Vulnerability Management 1.0 page is not migrated because the notifier attached to it no longer exists, then the details of that configuration are added to the logs generated by the Central pod. You can use details from the log to re-create the report configuration by clicking Vulnerability Management (2.0) → Vulnerability Reporting and adding a new report.

  • For each report configuration that was previously created by using the Vulnerability Management 1.0 page, the most recent successful scheduled report job is migrated to the All Report jobs section of the report configuration. To view the report configuration, click Vulnerability Management (2.0) → Vulnerability Reporting, and then click the report configuration.

If you need to roll back to RHACS 4.2 from a later version, the following actions occur:

  • The report configurations that became defunct with migration now become functional again and are available by clicking Vulnerability Management 1.0 → Reporting.

  • The report configurations created by the migration remain functional and are available by clicking Vulnerability Reporting 2.0 (Tech Preview). You can manually delete unwanted report configurations created in either the 1.0 or 2.0 reporting version.

  • If a report configuration in the Vulnerability Management 1.0 → Reporting page is updated after rolling back to RHACS 4.2 or earlier, those updates might not be applied to the migrated report configuration when the system is upgraded again. If this happens, the details of the report configuration are added to the logs generated by the Central pod. You can manually update the report configuration by clicking Vulnerability Management (2.0) → Vulnerability Reporting and using the details from the log.

  • Any new report configurations created in the Vulnerability Management 1.0 → Reporting page are migrated when you upgrade again to RHACS version 4.3 or later.

Additional resources