Translated from 日本語 • View original 
In this article, we will adopt a risk-based approach centered on severity and business value.
Here are the steps to respond to vulnerabilities without waste.
What is Dependabot?
- GitHub official dependency scanner
- Automatically generate update suggestions for vulnerable libraries in PRs
- Provides meta information such as CVSS score
- Works with GitHub Security Alerts
The Vulnerability Management Flow
How to Determine Priorities
1. Severity
Dependabot's PR includes CVSS-based severity:
2. Business Value
Rank systems and applications based on "criticality," "visibility," "data sensitivity," and more:
- High: Production publishing system, handling important customer information
- Medium: Internal business tool, private customer
- Low: For verification, staging environment, etc.
3. Classification
by Priority Matrix
*It is a good idea to decide on a response policy, such as immediate response for "top priority" and response within one week for "high".
Implementation Steps
(1) Enable Dependabot on GitHub
From the Security tab of the GitHub target repository, set it to Enabled:
(1) Enable Dependabot on GitHub
Check the severity from Dependabot Alert:
Conclusion
Vulnerability response is not "rushed", but it is important to "sharpen according to risk".
GitHub's Dependabot combined with a risk assessment matrix can help you balance security readiness with development efficiency.
However, many companies may be worried about how to evaluate the value of their assets and how to define their priorities.
Colorkrew Security provides support for on-site security measures.
If you would like to review the best response policy for your company, please feel free to contact us.