topic Vulnerability Remediation SLAS in Open Q&A

Vulnerability Remediation SLAS

pny10x64 — Tue, 16 Jan 2024 14:32:27 GMT

Hello,

Does Dynatrace publish vulnerability remediation SLAs or make information publicly available on how soon they make fixes available when a vulnerability is discovered? Specifically I am looking for information on SLAs for critical severity CVEs. Thanks.

Re: Vulnerability Remediation SLAS

natanael_mendes — Tue, 16 Jan 2024 14:52:57 GMT

Hey @pny10x64 i found something on Dynatrace Blog

#2 Clearly defined severities and SLA’s

Severity is very important as it not only defines impact but also defines the priority and “Time until Fix is in Production”. You could also explain it as our internal Service Level Agreement (SLA) until the problem is remediated for the customer. The following shows the full remediation timeline table explaining every severity level including our SLA to remediate the problem

https://www.dynatrace.com/news/blog/vulnerability-management-dynatraces-data-driven-approach-to-security/

In this Link you can see all the information that you want about SLA vulnerabilities in Dynatrace

Re: Vulnerability Remediation SLAS

Michael_Plank — Tue, 16 Jan 2024 15:02:15 GMT

Hi,

we have not publicly published our vulnerability remediation SLAs. Critical severity vulnerabilities (CVEs or vulnerabilities in our own code) are required to be remediated within 72 hours.