Merge pull request #263846 from veronikawithak/vbryan-security

Adding AVS Vulnerability Management to Security Section

Author: denrea

articles/azure-vmware/concepts-vulnerability-management.md

@@ -0,0 +1,49 @@
+---
+title: Concepts - How AVS Addresses Vulnerabilities in the Infrastructure
+description: The process that AVS follows to address security vulnerabilities.
+ms.topic: conceptual
+ms.service: azure-vmware
+ms.date: 01/18/2024
+ms.custom: engagement-fy24
+---
+
+
+# How AVS Addresses Vulnerabilities in the Infrastructure
+
+At a high level, Azure VMware Solution (AVS) is a Microsoft Azure service and therefore must follow all the same policies and requirements that Azure follows. Azure policies and procedures dictate that AVS must follow the [SDL](https://www.microsoft.com/securityengineering/sdl) and must meet several regulatory requirements as promised by Microsoft Azure. 
+
+## Our approach to vulnerabilities
+
+AVS takes a defense in depth approach to vulnerability and risk management. We follow the [SDL](https://www.microsoft.com/securityengineering/sdl) to ensure we're building securely from the start, including any third party solutions, and our services are continually assessed through both automation and manual reviews on a regular basis. Additionally, we also partner with third party partners on security hardening and early notifications of vulnerabilities within their solutions.
+
+### Vulnerability management
+
+- Engineering and Security Teams triage any signal of vulnerabilities.
+- Details within the signal are adjudicated and assigned a CVSS score and risk rating according to compensating controls within the service.
+- The risk rating is used against internal bug bars, internal policies and regulations to establish a timeline for implementing a fix.
+- Internal engineering teams partner with appropriate parties to qualify and roll out any fixes, patches and other configuration updates necessary.
+- Communications are drafted and published according to the risk rating assigned. 
+
+### Subset of regulations governing vulnerability and risk management
+
+AVS is in scope for the following certifications and regulatory requirements. The regulations listed aren't a complete list of certifications AVS holds, rather it's a list with specific requirements around vulnerability management. These regulations don't rely on other regulations for the same purpose. IE, certain regional certifications may point to ISO requirements for vulnerability management.
+
+>[!NOTE]
+>To access the following audit reports hosted in the Service Trust Portal, you must be an active Microsoft customer.
+
+- [ISO](https://servicetrust.microsoft.com/DocumentPage/38a05a38-6181-432e-a5ec-aa86008c56c9)
+- [PCI](https://servicetrust.microsoft.com/viewpage/PCI) \- See the packages for DSS and 3DS for Audit Information.
+- [SOC](https://servicetrust.microsoft.com/DocumentPage/f9858c69-b9c4-4097-9d09-1b95d3f994eb)
+- [NIST Cybersecurity Framework](https://servicetrust.microsoft.com/DocumentPage/bc0f7af3-5be8-427b-ac37-b84b86b6cc6b)
+- [Cyber Essentials Plus](https://servicetrust.microsoft.com/DocumentPage/d2758787-1e65-4894-891d-c11194721102)
+
+## More information
+[Azure VMware Solution Security Recommendations](/azure/azure-vmware/concepts-security-recommendations)
+
+[Azure VMware Solution Security Baseline](/security/benchmark/azure/baselines/azure-vmware-solution-security-baseline?toc=%2Fazure%2Fazure-vmware%2Ftoc.json)
+
+[Microsoft Azure’s defense in depth approach to cloud vulnerabilities](https://azure.microsoft.com/blog/microsoft-azures-defense-in-depth-approach-to-cloud-vulnerabilities/)
+
+[Microsoft Azure Compliance Offerings](/azure/compliance/)
+
+[Azure Service Health Portal](/azure/service-health/service-health-portal-update)

articles/azure-vmware/toc.yml

@@ -65,6 +65,8 @@ items:
       href: concepts-security-recommendations.md
     - name: Security baseline
       href: /security/benchmark/azure/baselines/azure-vmware-solution-security-baseline?toc=/azure/azure-vmware/toc.json
+    - name: AVS Vulnerability Management
+      href: concepts-vulnerability-management.md
   - name: Storage
     href: concepts-storage.md
 - name: How-to guides