SBOM-Based Vulnerability Management and VEX Workflows

# Generate comprehensive SBOM with all layers
syft . --scope all-layers -o spdx-json > inventory.json

# Include container base images
syft docker:node:18-alpine --scope all-layers >> base-inventory.json

# Merge SBOMs for complete view
sbom-merge inventory.json base-inventory.json > complete-sbom.json

#!/usr/bin/env python3
import json
import requests
from datetime import datetime

class SBOMVulnManager:
    def __init__(self, sbom_path):
        with open(sbom_path) as f:
            self.sbom = json.load(f)
        self.vulnerabilities = []

    def continuous_monitoring(self):
        """Monitor vulnerabilities in real-time"""
        for package in self.sbom['packages']:
            # Check multiple vulnerability databases
            vulns = []
            vulns.extend(self.check_nvd(package))
            vulns.extend(self.check_osv(package))
            vulns.extend(self.check_github(package))
            vulns.extend(self.check_snyk(package))

            for vuln in vulns:
                vuln['package'] = package['name']
                vuln['package_version'] = package['versionInfo']
                vuln['purl'] = package.get('externalRefs', [{}])[0].get('referenceLocator')

            self.vulnerabilities.extend(vulns)

    def prioritize_vulnerabilities(self):
        """Prioritize based on CVSS, exploitability, and usage"""
        for vuln in self.vulnerabilities:
            score = 0

            # CVSS score weight
            score += vuln.get('cvss_score', 0) * 2

            # Known exploits
            if vuln.get('exploits_available'):
                score += 3

            # Direct vs transitive dependency
            if self.is_direct_dependency(vuln['package']):
                score += 2

            # Component usage analysis
            if self.is_actively_used(vuln['package']):
                score += 2

            vuln['priority_score'] = score

        # Sort by priority
        self.vulnerabilities.sort(key=lambda x: x['priority_score'], reverse=True)

    def generate_vex(self):
        """Generate VEX (Vulnerability Exploitability eXchange)"""
        vex = {
            "document": {
                "category": "vex",
                "title": "Vulnerability Assessment",
                "version": "1.0",
                "timestamp": datetime.now().isoformat()
            },
            "statements": []
        }

        for vuln in self.vulnerabilities:
            statement = {
                "vulnerability": vuln['id'],
                "products": [vuln['purl']],
                "status": self.assess_vulnerability_status(vuln),
                "justification": self.get_justification(vuln),
                "impact_statement": vuln.get('impact', ''),
                "action_statement": self.get_recommended_action(vuln)
            }
            vex['statements'].append(statement)

        return vex

name: SBOM Vulnerability Monitoring
on:
  schedule:
    - cron: '0 */6 * * *'  # Every 6 hours
  workflow_dispatch:

jobs:
  vulnerability-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Generate SBOM
        run: |
          curl -sSfL https://get.anchore.io/syft | sh -s -- -b .
          ./syft . -o spdx-json > sbom.json

      - name: Vulnerability Scan with Grype
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b .
          ./grype sbom:sbom.json -o json > vulnerabilities.json

      - name: Check for Critical Vulnerabilities
        run: |
          CRITICAL=$(jq '.matches[] | select(.vulnerability.severity == "Critical") | length' vulnerabilities.json)
          if [ "$CRITICAL" -gt 0 ]; then
            echo "CRITICAL VULNERABILITIES FOUND: $CRITICAL"
            exit 1
          fi

      - name: Generate VEX Document
        run: python generate_vex.py sbom.json vulnerabilities.json > vex.json

      - name: Create Security Issue
        if: failure()
        uses: actions/github-script@v6
        with:
          script: |
            const fs = require('fs');
            const vulns = JSON.parse(fs.readFileSync('vulnerabilities.json'));
            const critical = vulns.matches.filter(m => m.vulnerability.severity === 'Critical');

            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `Critical Vulnerabilities Detected - ${new Date().toISOString().split('T')[0]}`,
              body: `## Critical Vulnerabilities Found\n\n${critical.map(v => 
                `- **${v.vulnerability.id}**: ${v.artifact.name}@${v.artifact.version}\n  - Severity: ${v.vulnerability.severity}\n  - Description: ${v.vulnerability.description}`
              ).join('\n\n')}`,
              labels: ['security', 'critical']
            });

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sbom-security-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sbom-security-operator
  template:
    spec:
      containers:
      - name: operator
        image: sbom-security-operator:latest
        env:
        - name: SCAN_INTERVAL
          value: "3600"  # 1 hour
        - name: VULNERABILITY_THRESHOLD
          value: "HIGH"
        volumeMounts:
        - name: config
          mountPath: /config
      volumes:
      - name: config
        configMap:
          name: sbom-security-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sbom-security-config
data:
  policy.yaml: |
    policies:
      - name: critical-vulnerabilities
        action: quarantine
        conditions:
          - severity: CRITICAL
          - cvss_score: ">= 9.0"
      - name: high-vulnerabilities
        action: alert
        conditions:
          - severity: HIGH
          - exploits_available: true

#!/bin/bash
# .git/hooks/pre-commit

echo "Checking for vulnerable dependencies..."

# Generate SBOM for staged changes
syft . -o spdx-json > /tmp/sbom.json

# Scan for vulnerabilities
grype sbom:/tmp/sbom.json --fail-on high

if [ $? -ne 0 ]; then
    echo "❌ High-severity vulnerabilities detected!"
    echo "Run 'grype sbom:/tmp/sbom.json' to see details"
    echo "Fix vulnerabilities before committing"
    exit 1
fi

echo "✅ No high-severity vulnerabilities found"

// .vscode/settings.json
{
    "sbom.autoGenerate": true,
    "sbom.vulnerabilityCheck": "onSave",
    "sbom.excludePatterns": ["test/*", "docs/*"],
    "sbom.alertLevel": "HIGH",
    "extensions.recommendations": ["sbom-security.vscode-sbom"]
}

// update-dependencies.js
const fs = require('fs');
const { execSync } = require('child_process');

class DependencyUpdater {
    constructor(sbomPath) {
        this.sbom = JSON.parse(fs.readFileSync(sbomPath, 'utf8'));
        this.vulnerabilities = [];
    }

    async findVulnerablePackages() {
        const grypeResult = execSync('grype sbom:sbom.json -o json');
        const scan = JSON.parse(grypeResult.toString());

        return scan.matches.filter(match => 
            ['Critical', 'High'].includes(match.vulnerability.severity)
        );
    }

    async generateUpdatePlan() {
        const vulnerablePackages = await this.findVulnerablePackages();
        const updatePlan = [];

        for (const vuln of vulnerablePackages) {
            const fixedVersion = await this.findFixedVersion(
                vuln.artifact.name, 
                vuln.vulnerability.id
            );

            if (fixedVersion) {
                updatePlan.push({
                    package: vuln.artifact.name,
                    currentVersion: vuln.artifact.version,
                    fixedVersion: fixedVersion,
                    vulnerability: vuln.vulnerability.id,
                    severity: vuln.vulnerability.severity
                });
            }
        }

        return updatePlan;
    }

    async createPullRequest(updatePlan) {
        // Create branch
        execSync('git checkout -b update-vulnerable-deps');

        // Update package.json
        for (const update of updatePlan) {
            const cmd = `npm install ${update.package}@${update.fixedVersion}`;
            execSync(cmd);
        }

        // Generate new SBOM
        execSync('syft . -o spdx-json > sbom-updated.json');

        // Commit changes
        execSync('git add package.json package-lock.json sbom-updated.json');
        execSync(`git commit -m "Security: Update vulnerable dependencies

${updatePlan.map(u => `- ${u.package}: ${u.currentVersion} → ${u.fixedVersion} (fixes ${u.vulnerability})`).join('\n')}
        "`);

        // Push and create PR (GitHub CLI required)
        execSync('git push origin update-vulnerable-deps');
        execSync(`gh pr create --title "Security: Update vulnerable dependencies" --body "Automated security updates for ${updatePlan.length} vulnerable packages"`);
    }
}

from flask import Flask, jsonify, render_template
import json
import sqlite3
from datetime import datetime

app = Flask(__name__)

class SBOMSecurityDashboard:
    def __init__(self, db_path):
        self.db = sqlite3.connect(db_path)
        self.init_db()

    def init_db(self):
        self.db.execute('''
            CREATE TABLE IF NOT EXISTS vulnerabilities (
                id TEXT PRIMARY KEY,
                package_name TEXT,
                package_version TEXT,
                vulnerability_id TEXT,
                severity TEXT,
                cvss_score REAL,
                discovered_at TIMESTAMP,
                fixed_version TEXT,
                status TEXT,
                project_name TEXT
            )
        ''')

    def ingest_sbom_scan(self, project_name, sbom_data, vuln_data):
        """Ingest SBOM and vulnerability scan results"""
        for match in vuln_data['matches']:
            vuln_id = f"{project_name}-{match['artifact']['name']}-{match['vulnerability']['id']}"

            self.db.execute('''
                INSERT OR REPLACE INTO vulnerabilities VALUES 
                (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
            ''', (
                vuln_id,
                match['artifact']['name'],
                match['artifact']['version'],
                match['vulnerability']['id'],
                match['vulnerability']['severity'],
                match['vulnerability'].get('cvss_score', 0),
                datetime.now(),
                match['vulnerability'].get('fixed_version'),
                'open',
                project_name
            ))
        self.db.commit()

    @app.route('/api/dashboard')
    def dashboard_data(self):
        cursor = self.db.execute('''
            SELECT 
                severity,
                COUNT(*) as count,
                COUNT(CASE WHEN status = 'open' THEN 1 END) as open_count
            FROM vulnerabilities 
            GROUP BY severity
        ''')

        stats = {}
        for row in cursor:
            stats[row[0]] = {
                'total': row[1],
                'open': row[2]
            }

        return jsonify(stats)

    @app.route('/api/projects/<project>/vulnerabilities')
    def project_vulnerabilities(self, project):
        cursor = self.db.execute('''
            SELECT * FROM vulnerabilities 
            WHERE project_name = ? AND status = 'open'
            ORDER BY cvss_score DESC
        ''', (project,))

        vulns = []
        for row in cursor:
            vulns.append({
                'package': row[1],
                'version': row[2],
                'vulnerability_id': row[3],
                'severity': row[4],
                'cvss_score': row[5],
                'discovered_at': row[6],
                'fixed_version': row[7]
            })

        return jsonify(vulns)

if __name__ == '__main__':
    dashboard = SBOMSecurityDashboard('sbom_security.db')
    app.run(host='0.0.0.0', port=5000)

def generate_soc2_report(start_date, end_date):
    """Generate SOC 2 compliance report for vulnerability management"""

    report = {
        'period': f"{start_date} to {end_date}",
        'controls': {
            'CC6.1': {
                'description': 'Vulnerability identification process',
                'evidence': [
                    'Automated SBOM generation for all applications',
                    'Daily vulnerability scanning of all SBOMs',
                    'Integration with 4 vulnerability databases (NVD, OSV, GitHub, Snyk)'
                ],
                'effectiveness': 'Effective'
            },
            'CC6.2': {
                'description': 'Vulnerability assessment and remediation',
                'metrics': {
                    'mean_time_to_detect': '< 24 hours',
                    'mean_time_to_remediate_critical': '< 72 hours',
                    'mean_time_to_remediate_high': '< 7 days'
                },
                'effectiveness': 'Effective'
            }
        }
    }

    return report

# compliance-mapping.yaml
frameworks:
  NIST_CSF:
    - ID.AM-2: "Software platforms and applications within the organization are inventoried"
      implementation: "SBOM generation for all applications"
      automation: "Continuous SBOM updates with CI/CD"

    - DE.CM-8: "Vulnerability scans are performed"
      implementation: "SBOM-based vulnerability scanning"
      frequency: "Every 6 hours"

  ISO_27001:
    - A.12.6.1: "Management of technical vulnerabilities"
      implementation: "Automated vulnerability detection via SBOM analysis"
      evidence: "VEX documents and remediation tracking"

  SOX:
    - Section_404: "Internal controls over financial reporting"
      implementation: "SBOM vulnerability tracking for financial systems"
      reporting: "Monthly vulnerability status reports"

# KPIs for SBOM-based vulnerability management
metrics:
  discovery:
    - mean_time_to_detect: "< 24 hours"
    - coverage_percentage: "> 95%"
    - false_positive_rate: "< 5%"

  response:
    - mean_time_to_triage: "< 4 hours"
    - mean_time_to_remediate_critical: "< 72 hours"
    - mean_time_to_remediate_high: "< 7 days"

  prevention:
    - vulnerabilities_prevented: "Count blocked in CI/CD"
    - dependency_freshness: "Average age < 90 days"
    - security_debt: "Total vulnerability age"