SAS Viya Marketplace - Vulnerabilities treatment in Azure

[fnajera]

Hi team,

As you know, when SAS Viya is deployed via marketplace, two managed group nodes are created by the managed application. Obviously we don't have access to those groups. However, Azure Security is notifying about the following vulnerabilities. How can we address them? 

Please let me know if you need further information.

Thank you.

[fnajera]

Any update about this question? We cannot go on production, because security team is concerned about these vulnerability alerts

[Conor_H]

Thank you for bringing the Azure security recommendations to our attention. We are conducting a review of the recommendations to ensure that the high severity vulnerabilities are addresses first. I will provide an update when that review is complete. Note that some of the medium and low alerts may trigger additional infrastructure costs for additional Microsoft security products or services. 

[fnajera]

Thank you so much Conor, Please let me know if you need further information, and we're looking forward to know about the review.

[fnajera]

Sorry Conor, just to notify to the stakeholders, what is a likely date for having these vulnerabilities solved?

[Conor_H]

We’ve reviewed the security vulnerabilities highlighted by Microsoft Defender. While we plan to address several issues, we may not resolve all, especially those involving additional Azure services that increase costs. An independent third party has verified our security and conducted a thorough vulnerabilities scan. We appreciate your understanding as we balance security with cost-effectiveness.

[fnajera]

Thank you so much for your update Conor. Is there a list of the vulnerabilities that SAS may resolve that does not affect costs? So we can inform to the Security Team. Thanks as always.