What is the difference between Mitigation status and Remediation status?

Remediation is the act of removing the flaw in the code to prevent its exploitation. Status refers to remediation status, and infers if a flaw was found or not. There are four possible values:
 
New: Flaw has never been found
Open: Flaw was found in the current and previous scan
Closed: Flaw was not found in the current scan
Re-Open: Flaw was found in the current scan but was Closed in the previous scan.
 
Mitigation is the act of documenting and accepting the risk of a flaw. It can be done for many reasons, but the most common is due to factors outside of the scope of the scan (ex. network environment), making the potential for said risk moot. There are four possible values:
 
None: There have been no mitigations associated with this flaw
Proposed: A mitigation has been documented and is awaiting review
Approved: The proposed mitigation has been reviewed and deemed acceptable
Rejected: The proposed mitigation has been reviewed and deemed unaccaptable
 
As you can see, these concepts are independent of each other. This means that a flaw that has a mitigation associated with it is most likely going to continue to be found, as the purpose of a mitigation is to accept the risk of a flaw rather than remove the flaw.
 
 

Topics (1)

Related Articles

Related Topics

    Ask the Community

    Get answers, share a use case, discuss your favorite features, or get input from the Community.