In this project, we simulate the implementation of a comprehensive vulnerability management program, from inception to completion.
Inception State: the organization has no existing policy or vulnerability management practices in place.
Completion State: a formal policy is enacted, stakeholder buy-in is secured, and a full cycle of organization-wide vulnerability remediation is successfully completed.
- Tenable (enterprise vulnerability management platform)
- Azure Virtual Machines (Nessus scan engine + scan targets)
- PowerShell & BASH (remediation scripts)
- Vulnerability Management Policy Draft Creation
- Mock Meeting: Policy Buy-In (Stakeholders)
- Policy Finalization and Senior Leadership Sign-Off
- Mock Meeting: Initial Scan Permission (Server Team)
- Initial Scan of Server Team Assets
- Vulnerability Assessment and Prioritization
- Distributing Remediations to Remediation Teams
- Mock Meeting: Post-Initial Discovery Scan (Server Team)
- Mock CAB Meeting: Implementing Remediations
- Remediation Round 1: Outdated Wireshark Removal
- Remediation Round 2: Insecure Protocols & Ciphers
- Remediation Round 3: Guest Account Group Membership
- Remediation Round 4: Windows OS Updates
- First Cycle Remediation Effort Summary
This phase focuses on drafting a Vulnerability Management Policy as a starting point for stakeholder engagement. The initial draft outlines scope, responsibilities, and remediation timelines, and may be adjusted based on feedback from relevant departments to ensure practical implementation before final approval by upper management.
Draft Policy
In this phase, a meeting with the server team introduces the draft Vulnerability Management Policy and assesses their capability to meet remediation timelines. Feedback leads to adjustments, like extending the critical remediation window from 48 hours to one week, ensuring collaborative implementation.
Josh:
Good morning, Jimmy. How have things been lately. I know everyone has been busy these past few weeks.
Jimmy:
Good morning, Josh. It has been hectic, but we are managing. Thanks for asking. I had a chance to review the policy draft. Overall, it makes sense. Our concern is the remediation timelines. With our current staffing, the 48 hour window for critical vulnerabilities will be difficult to meet.
Josh:
I understand. It is aggressive, especially at the start. We can extend the critical remediation window to one week. We can reserve the 48 hour requirement for truly severe cases like zero day vulnerabilities.
Jimmy:
That sounds reasonable. We appreciate the flexibility. Would it be possible to have some leeway at the beginning while we adjust to the remediation and patching process.
Josh:
Absolutely. Once the policy is finalized, we will officially roll out the program. We plan to give all departments about six months to adjust and get comfortable with the new process. Does that sound fair.
Jimmy:
Yes, that works for us. Thank you for including us in the decision making process. It helps us feel like part of the solution.
Josh:
Of course. We are all in this together. Thanks for working with us.
Jimmy:
No problem. Thanks for the quick meeting.
Josh:
Those are my favorite kind. Take care.
Jimmy:
You too. Talk soon.
After gathering feedback from the server team, the policy is revised, addressing aggressive remediation timelines. With final approval from upper management, the policy now guides the program, ensuring compliance and reference for pushback resolution.
Finalized Policy
The team collaborates with the server team to initiate scheduled credential scans. A compromise is reached to scan a single server first, monitoring resource impact, and using just-in-time Active Directory credentials for secure, controlled access.
Josh:
Good morning, Jimmy.
Jimmy:
Good morning. I heard you are ready to conduct some scans.
Josh:
Yes. Now that our vulnerability management policy is in place, I wanted to get started with scheduled credentialed scans of your environment.
Jimmy:
Sounds good. What does that involve and how can we help.
Josh:
We plan to schedule weekly scans of the server infrastructure. The scan should take about four to six hours to complete across roughly two hundred assets. We will need administrative credentials so the scanner can log in and properly assess each system.
Jimmy:
Hold on. What exactly does the scanning involve. I am a bit concerned about resource usage. Also, providing admin credentials to all two hundred machines sounds risky.
Josh:
Those are valid concerns. The scan sends controlled traffic to check for known vulnerabilities. This includes reviewing registry settings, identifying outdated software, and checking for insecure protocols or cipher suites. Credentials are required to perform these checks accurately.
Jimmy:
I see. As long as it does not impact system availability, I think we can proceed.
Josh:
To be safe, we can start with a single server and monitor resource usage before expanding to the rest of the environment.
Jimmy:
That sounds reasonable.
Josh:
For the credentials, could you create an Active Directory account for scanning purposes. It can remain disabled until the scan window. Afterward, we can disable or deprovision it. This would function like just in time access.
Jimmy:
That works. I will ask Susan to begin setting up the automation for the account.
Josh:
Perfect. I will follow up once everything is ready.
Jimmy:
Sounds good. Talk to you soon.
Josh:
See you later.
In this phase, an insecure Windows Server is provisioned to simulate the server team's environment. After creating vulnerabilities, an authenticated scan is performed, and the results are exported for future remediation steps.
We assessed vulnerabilities and established a remediation prioritization strategy based on ease of remediation and impact. The following priorities were set:
- Third Party Software Removal (Wireshark)
- Windows OS Secure Configuration (Protocols & Ciphers)
- Windows OS Secure Configuration (Guest Account Group Membership)
- Windows OS Updates
The server team received remediation scripts and scan reports to address key vulnerabilities. This streamlined their efforts and prepared them for a follow-up review.
The server team reviewed vulnerability scan results, identifying outdated software, insecure accounts, and deprecated protocols. The remediation packages were prepared for submission to the Change Control Board (CAB).
Josh:
Good morning, Jimmy. How are you doing.
Jimmy:
Not bad for a Monday. How about you.
Josh:
Still alive, so I cannot complain. Before we get into the vulnerabilities, how did the scan go on your end. Did you notice any outages or resource issues.
Jimmy:
The scan went well. We monitored it closely, and aside from the open connections, we would not have known a scan was taking place.
Josh:
That is good to hear. I expected that result. We will continue to monitor, but I do not expect any resource utilization issues. Do you mind if I walk through the findings.
Jimmy:
Go ahead.
Josh:
I am going to share my screen. Most of the findings are related to Wireshark being installed. It is simply out of date. One thing that stood out is that the local guest account belongs to the local administrators group. I am not sure why that is configured that way.
Some of the other findings may be resolved automatically through Windows Updates, such as the Microsoft Edge Chromium issue. The self signed certificate is not a concern. However, the medium strength cipher suites and TLS 1.0 and 1.1 are deprecated and should be remediated.
So the main issues we are looking at are:
- Outdated Wireshark installation
- Deprecated cipher suites and protocols
- Guest account membership in the local administrators group
Jimmy:
That is interesting. The good news is that most of our servers probably have the same configuration. That should make remediation easier.
Josh:
Exactly. A uniform setup usually helps. Do you see any issues with remediating the cipher suites or disabling the insecure protocols.
Jimmy:
I do not expect any issues. We will run it through the Change Control Board. Removing Wireshark and fixing the guest account should not be a problem. Those should not be on the servers anyway. I will check with the CIS admins to confirm.
Josh:
That is great to hear. I will start building remediation packages to make the process easier on your end.
Jimmy:
Sounds good. One question though. Do you already have something in place to handle Windows update related vulnerabilities.
Josh:
Yes. Windows updates are handled through our patch management process. Everything should be patched automatically by next week.
Jimmy:
Perfect.
Josh:
I will start researching the best remediation steps and follow up before the next Change Control Board meeting.
Jimmy:
Sounds good. Talk to you soon.
Josh:
Talk to you soon.
The Change Control Board (CAB) reviewed and approved the plan to remove insecure protocols and cipher suites. The plan included a rollback script and a tiered deployment approach.
Moderator:
Next on the agenda are vulnerability remediation items for the server team. The focus is on the removal of insecure protocols and insecure cipher suites. Josh from Risk is working with Jimmy from Infrastructure on this effort. Jimmy, do you want to walk us through the technical details.
Jimmy:
Normally I would, but do you mind passing this one to Josh. He built the solution and we are still getting used to the process.
Josh:
Sure. I can walk everyone through it. The presence of insecure cipher suites and protocols means the system is capable of negotiating deprecated or weak encryption methods. If a server attempts to use one of those methods, the system could accept it, which creates risk.
These settings are controlled through the Windows registry. The fix is straightforward. We developed a PowerShell script that disables insecure protocols and cipher suites and enables only the currently approved secure standards.
Moderator:
That sounds reasonable. What happens if something goes wrong. Do we have a rollback plan.
Josh:
Yes, we do. We are using a tiered deployment approach. It starts with a small pilot group, then pre production, and finally production.
In addition, we built an automated rollback script. If any issues occur, the script restores the original protocol and cipher settings automatically.
Moderator:
That is good to hear. Since the changes are registry based, the risk seems minimal.
Josh:
Exactly. The change is controlled, reversible, and well tested.
Moderator:
Any other questions from the group.
Moderator:
Alright. That wraps up this week's CAB meeting. See everyone next week.
All:
See you later.
The server team used a PowerShell script to remove outdated Wireshark. A follow-up scan confirmed successful remediation.
Wireshark Removal Script
Scan 2 - Third Party Software Removal
The server team used PowerShell scripts to remediate insecure protocols and cipher suites. A follow-up scan verified successful remediation, and the results were saved for reference.
PowerShell: Insecure Protocols Remediation
PowerShell: Insecure Ciphers Remediation
Scan 3 - Ciphersuites and Protocols
The server team removed the guest account from the administrator group. A new scan confirmed remediation, and the results were exported for comparison.
PowerShell: Guest Account Group Membership Remediation
Scan 4 - Guest Account Group Removal
Windows updates were re-enabled and applied until the system was fully up to date. A final scan verified the changes
The remediation process reduced total vulnerabilities by 80%, from 30 to 6. Critical vulnerabilities were resolved by the second scan (100%), and high vulnerabilities dropped by 90%. Mediums were reduced by 76%. In an actual production environment, asset criticality would further guide future remediation efforts.
After completing the initial remediation cycle, the vulnerability management program transitions into Maintenance Mode. This phase ensures that vulnerabilities continue to be managed proactively, keeping systems secure over time. Regular scans, continuous monitoring, and timely remediation are crucial components of this phase. (See Finalized Policy for scanning and remediation cadence requirements.)
Key activities in Maintenance Mode include:
- Scheduled Vulnerability Scans: Perform regular scans (e.g., weekly or monthly) to detect new vulnerabilities as systems evolve.
- Patch Management: Continuously apply security patches and updates, ensuring no critical vulnerabilities remain unpatched.
- Remediation Follow-ups: Address newly identified vulnerabilities promptly, prioritizing based on risk and impact.
- Policy Review and Updates: Periodically review the Vulnerability Management Policy to ensure it aligns with the latest security best practices and organizational needs.
- Audit and Compliance: Conduct internal audits to ensure compliance with the vulnerability management policy and external regulations.
- Ongoing Communication with Stakeholders: Maintain open communication with teams responsible for remediation, ensuring efficient coordination.
By maintaining an active vulnerability management process, organizations can stay ahead of emerging threats and ensure long-term security resilience.