.

security/scanning/vulnerability-scanning/references/remediation-guide.md

@@ -0,0 +1,135 @@
+# Vulnerability Remediation Guide
+
+## Triage Process
+
+### 1. Assess Impact
+- Is the vulnerability exploitable in your context?
+- Is the vulnerable component reachable?
+- What's the potential business impact?
+
+### 2. Prioritize
+```
+Priority Matrix:
+                    Exploitable
+                    Yes         No
+Impact  High        P1-Critical P2-High
+        Medium      P2-High     P3-Medium
+        Low         P3-Medium   P4-Low
+```
+
+### 3. Remediation Options
+
+| Option | When to Use |
+|--------|-------------|
+| **Upgrade** | Fix available, no breaking changes |
+| **Patch** | Apply security patch |
+| **Workaround** | Mitigate until fix available |
+| **Accept** | Risk accepted with documentation |
+| **Remove** | Dependency not needed |
+
+## Common Remediation Steps
+
+### Container Base Images
+
+```dockerfile
+# Before: Vulnerable base
+FROM ubuntu:20.04
+
+# After: Updated base
+FROM ubuntu:22.04
+
+# Better: Minimal base
+FROM gcr.io/distroless/base-debian12
+```
+
+### JavaScript Dependencies
+
+```bash
+# View outdated packages
+npm outdated
+
+# Update specific package
+npm update lodash
+
+# Update all (careful!)
+npm update
+
+# Force resolution
+npm audit fix --force
+
+# Check for updates
+npx npm-check-updates
+```
+
+### Python Dependencies
+
+```bash
+# Update specific package
+pip install --upgrade requests
+
+# Update with constraints
+pip install 'requests>=2.28.0,<3.0.0'
+
+# Using pip-tools
+pip-compile --upgrade requirements.in
+```
+
+### Terraform Providers
+
+```hcl
+# Pin to secure version
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"  # Update to latest minor
+    }
+  }
+}
+```
+
+## False Positive Handling
+
+### Trivy Ignore
+```yaml
+# .trivyignore
+CVE-2022-12345  # Reason: Not exploitable in our context
+CVE-2022-67890  # Reason: Component not exposed
+```
+
+### Grype Ignore
+```yaml
+# .grype.yaml
+ignore:
+  - vulnerability: CVE-2022-12345
+    reason: "Not applicable - component not used"
+```
+
+## Documentation Template
+
+```markdown
+## Vulnerability Assessment: CVE-XXXX-XXXXX
+
+**Severity:** High (CVSS 7.5)
+**Component:** package-name v1.2.3
+**Status:** [Remediated/Accepted/Pending]
+
+### Description
+Brief description of the vulnerability.
+
+### Impact Assessment
+- Exploitability in our environment: [Yes/No/Partial]
+- Affected systems: [List systems]
+- Business impact: [Description]
+
+### Remediation
+- Action taken: Upgraded to v1.2.4
+- Date: YYYY-MM-DD
+- Verified by: [Name]
+
+### If Accepted
+- Reason for acceptance:
+- Compensating controls:
+- Review date:
+- Approved by:
+```

security/scanning/vulnerability-scanning/references/scanner-comparison.md

@@ -0,0 +1,93 @@
+# Vulnerability Scanner Comparison
+
+## Container Image Scanners
+
+| Tool | License | Speed | Database | CI Integration |
+|------|---------|-------|----------|----------------|
+| **Trivy** | Apache 2.0 | Fast | NVD, Red Hat, etc. | Excellent |
+| **Grype** | Apache 2.0 | Fast | Anchore DB | Good |
+| **Clair** | Apache 2.0 | Medium | NVD, Alpine, etc. | Good |
+| **Snyk** | Commercial | Fast | Snyk DB | Excellent |
+| **Docker Scout** | Commercial | Fast | Docker DB | Native |
+
+## Recommended: Trivy
+
+### Installation
+```bash
+# Homebrew
+brew install trivy
+
+# APT
+apt-get install trivy
+
+# Docker
+docker run aquasec/trivy image nginx:latest
+```
+
+### Basic Usage
+```bash
+# Scan image
+trivy image nginx:latest
+
+# Scan with severity filter
+trivy image --severity HIGH,CRITICAL nginx:latest
+
+# Scan and fail on vulnerabilities
+trivy image --exit-code 1 --severity CRITICAL nginx:latest
+
+# JSON output
+trivy image -f json -o results.json nginx:latest
+
+# Scan filesystem
+trivy fs /path/to/project
+
+# Scan Kubernetes
+trivy k8s --report summary cluster
+```
+
+### GitHub Actions
+```yaml
+- name: Run Trivy vulnerability scanner
+  uses: aquasecurity/trivy-action@master
+  with:
+    image-ref: 'myapp:${{ github.sha }}'
+    format: 'sarif'
+    output: 'trivy-results.sarif'
+    severity: 'CRITICAL,HIGH'
+    
+- name: Upload Trivy scan results
+  uses: github/codeql-action/upload-sarif@v2
+  with:
+    sarif_file: 'trivy-results.sarif'
+```
+
+## Dependency Scanners
+
+| Tool | Languages | License |
+|------|-----------|---------|
+| **npm audit** | JavaScript | Free |
+| **pip-audit** | Python | Free |
+| **bundle audit** | Ruby | Free |
+| **cargo audit** | Rust | Free |
+| **Snyk** | Multi | Commercial |
+| **Dependabot** | Multi | Free (GitHub) |
+| **OWASP Dependency-Check** | Multi | Apache 2.0 |
+
+## Infrastructure as Code Scanners
+
+| Tool | Targets | License |
+|------|---------|---------|
+| **tfsec** | Terraform | MIT |
+| **checkov** | TF, CloudFormation, K8s | Apache 2.0 |
+| **kics** | Multi IaC | Apache 2.0 |
+| **kubesec** | Kubernetes | Apache 2.0 |
+
+## CVSS Score Reference
+
+| Score | Severity |
+|-------|----------|
+| 0.0 | None |
+| 0.1-3.9 | Low |
+| 4.0-6.9 | Medium |
+| 7.0-8.9 | High |
+| 9.0-10.0 | Critical |