Traceability between Vulnerabilities, Components and Actions
🌟 Objective
Ensure that each vulnerability identified in third-party components has complete traceability from its origin (SBOM + SCA), through analysis, to remediation or documented acceptance.
✅ This traceability makes it possible to demonstrate compliance, mitigate risks in a justified way, and maintain control over the real security state of the dependencies.
🔢 Elements of traceability
| Element | Example |
|---|---|
| Component | log4j:log4j-core@2.14.1 |
| SBOM identifier | purl:maven/log4j/log4j-core@2.14.1 |
| Finding / CVE | CVE-2021-44228 |
| Scanner / Report | grype, snyk, OWASP DC, etc. |
| Affected artefact | app-backend-1.2.5.jar |
| Origin commit | abc123 (pull request where the dep was used) |
| Associated task | EX-SEC-456 (issue, PR or remediation task) |
| Final state | Fixed / Accepted with justification |
Illustrative identifiers (EX-…); they do not correspond to the Requirements Catalogue of Ch. 02.
📄 Record template
# Identificadores ilustrativos (EX-…); não correspondem ao Catálogo de Requisitos do Cap. 02.
- cve: CVE-2021-44228
componente: log4j-core@2.14.1
purl: pkg:maven/log4j/log4j-core@2.14.1
artefacto: app-v1.2.5.jar
introduzido_por: commit abc123
tarefa: EX-SEC-456
decisao: corrigido
evidencias:
- commit: def789
- release: v1.2.6
- scanner: grype-scan-2024-06-02.json
📁 It is suggested that this record be kept in a versioned file (
vulns.yaml) or in a database integrated with Jira or GitHub Projects.
🛠️ Integration with ALM / backlog
- SCA findings must automatically create remediation tasks (via API or webhook)
- Tickets must contain:
- Link to the CVE (NVD, GH Advisory)
- Affected components
- SBOM + affected pipeline
- Acceptance criterion (validated fix or approved exception)
🔗 Use normalised labels:
cve,sca,seguranca,sbom,rastreabilidade
✅ Finding closure criteria
| Final state | Mandatory requirements |
|---|---|
| Fixed | PR with the update, new release validated by SCA |
| Accepted | Technical justification + AppSec/documented approval |
| Mitigated | Compensating control + technical validation + defined deadline |
| Obsolete | Package no longer in use (excluded from the current SBOM) |
🔗 Links to other files
| Document | Role in traceability |
|---|---|
01-inventario-sbom.md | Source of components by version |
02-analise-sca.md | Generates findings with references to CVEs |
04-integracao-ci-cd.md | Connects findings to the artefact and release |
09-excecoes-e-aceitacao-risco.md | Formalises acceptance of findings if they are not fixed |
🔒 Traceability is a critical factor in audits, incident response and security governance. It must be systematised, versioned and accessible.