Solution Validation: Dismissal Types
What's this issue all about? (Background and context)
Both external teams in internal counterparts have requested the ability to define a reason when dismissing a vulnerability. This is a pivotal component in vulnerability management since security teams refer back to these reasons for compliance audits and even when triaging similar vulnerabilities.
What hypotheses and/or assumptions do you have?
We believe these are the appropriate values that will encompass >90% of all uses cases when users decide not to address a detected vulnerability.
- Accept risk
- False positive
- Mitigating control
- Out of scope
What questions are you trying to answer?
- Are these the correct values users would expect?
- Do these values account for >90 of the cases users would normally encounter?
What research methodology do you intend to use?
Internal interviews with the security team. Considering a larger survey.
What persona, persona segment, or customer type experiences the problem most acutely?
What business decisions will be made based on this information?
What, if any, relevant prior research already exists?
N/A
Who will be leading the research?
What timescales do you have in mind for the research?
1 Milstone - %13.5
Relevant links (problem validation issue, design issue, script, prototype, notes, etc.)
Edited by Andy Volpe