Vulnerability Management

Status: TODO

Sources to monitor

• Raspberry Pi / Debian security advisories
• Linux kernel
• Go dependencies
• NATS client/server components used by the product
• VPN implementation
• Modbus libraries
• image build dependencies

Workflow

new advisory/report
  -> triage
  -> affected versions identified
  -> severity assigned
  -> fix/mitigation
  -> test
  -> signed release
  -> deployment
  -> customer communication if required
  -> closure with evidence

Required records

Use vulnerability-register.csv.