Accept vulnerabilities

The Acceptance section in Policies shows the weaknesses  that your team has requested be permanently and temporarily accepted. Accepting vulnerabilities means acknowledging and tolerating their associated risks. The policies approved here apply to reports across all the groups within your organization.

Accept vulnerabilities permanently

The first table in Acceptance lists the weaknesses your team has suggested for permanent acceptance, as well as the request status (‘Approved’, ‘Rejected’, ‘Requested’, or ‘Inactive’), the request date, and any tags for classification added by the person who made it. Organization Managers  can see in the Action column the options to manage permanent acceptance.

Submit a weakness to accept

Any team member can make the approval request, but only Organization Managers  can approve or reject it. To add a weakness, follow these steps:

1. Click on the Add weakness button. This makes a pop-up window appear for you to select the weakness you want to submit for acceptance.

In case the request has already been made, it is displayed as unavailable, and you are informed of the request status.

1. Optionally, add one or more tags for classification.
2. Click on the Request button to submit the request.

Upon clicking the Request button, the weakness appears in the table with ‘Requested’ in the Request status column.

Approve and reject acceptance requests

The Action column presents you with options to manage acceptance requests. Those in the ‘Requested’ status show you the Pending approval button. Manage them as follows:

1. Approve: You approve the request, causing every vulnerability that matches the type or type-tag combination to be accepted with no additional approvals needed. This changes the request status from ‘Requested’ to ‘Approved’.
2. Reject: You reject the request. This changes its status to ‘Rejected’.

Reactivate and deactivate the acceptance policy

For requests whose status is ‘Approved’, ‘Rejected’ and ‘Inactive’, the Action column presents you with the Manage button. Manage these requests as follows:

1. Click on Request to reactivate acceptance.

   

   You have to confirm the action. Doing so changes the policy status from ‘Rejected’ or ‘Inactive’ to ‘Approved’.

   

2. Click on Deactivate to stop accepting the weakness.

   

   Upon clicking the button, a pop-up window appears asking for confirmation. By clicking on Confirm, this policy’s status changes from ‘Approved’ to ‘Inactive’.

   

Add tags to classify vulnerabilities for acceptance

When submitting a weakness  in Acceptance, you can add one or more tags to classify it. These tags are meant to help you find information fast in future searches and allow you to do analyses using categories that your team finds meaningful. For the latter, Fluid Attacks offers the analytics Tags by groups  and Weaknesses by tags .

Accept vulnerabilities temporarily

The second table in Acceptance shows the weaknesses your team has suggested for temporary acceptance, as well as the corresponding request status, date and tags. Additionally, Organization Managers  are offered multiple options to manage requests.

A temporary acceptance policy can be created for an individual weakness or all vulnerability types:

1. To submit a request for one weakness, click on Add weakness, select the weakness and click the Request button. You can optionally add tags. Bear in mind that you can only choose among the weaknesses for which a request has not been made.

   

Upon clicking Request, the policy appears in the table with the ‘Requested’ status. Only a member with the Organization Manager  role can approve or reject  it.

1. To submit a request for all weaknesses, select All vulnerability types after clicking on the Weakness field, then add tags (optional) and click on the plus button.

Members with the Organization Manager role can manage temporary acceptance from the Action column as follows:

1. Pending approval > Approve to start accepting the weakness
2. Pending approval > Reject to disallow acceptance of the weakness
3. Manage > Request to activate acceptance of the weakness
4. Manage > Deactivate to stop accepting the weakness