topic Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure in SAS Viya (Pay-As-You-Go)

SAS Viya Marketplace - Vulnerabilities treatment in Azure

fnajera — Mon, 17 Jun 2024 19:57:04 GMT

Hi team,

As you know, when SAS Viya is deployed via marketplace, two managed group nodes are created by the managed application. Obviously we don't have access to those groups. However, Azure Security is notifying about the following vulnerabilities. How can we address them?

Please let me know if you need further information.

Thank you.

Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure

fnajera — Wed, 19 Jun 2024 17:16:56 GMT

Any update about this question? We cannot go on production, because security team is concerned about these vulnerability alerts

Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure

Conor_H — Sat, 22 Jun 2024 12:35:52 GMT

Thank you for bringing the Azure security recommendations to our attention. We are conducting a review of the recommendations to ensure that the high severity vulnerabilities are addresses first. I will provide an update when that review is complete. Note that some of the medium and low alerts may trigger additional infrastructure costs for additional Microsoft security products or services.

Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure

fnajera — Mon, 24 Jun 2024 19:25:46 GMT

Thank you so much Conor, Please let me know if you need further information, and we're looking forward to know about the review.

Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure

fnajera — Mon, 24 Jun 2024 19:28:17 GMT

Sorry Conor, just to notify to the stakeholders, what is a likely date for having these vulnerabilities solved?

Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure

Conor_H — Wed, 17 Jul 2024 13:16:27 GMT

We’ve reviewed the security vulnerabilities highlighted by Microsoft Defender. While we plan to address several issues, we may not resolve all, especially those involving additional Azure services that increase costs. An independent third party has verified our security and conducted a thorough vulnerabilities scan. We appreciate your understanding as we balance security with cost-effectiveness.

Re: SAS Viya Marketplace - Vulnerabilities treatment in Azure

fnajera — Wed, 17 Jul 2024 19:21:10 GMT

Thank you so much for your update Conor. Is there a list of the vulnerabilities that SAS may resolve that does not affect costs? So we can inform to the Security Team. Thanks as always.