From zero security posture to full organizational remediation cycle — implementing enterprise vulnerability management end-to-end using Tenable, Azure VMs, and PowerShell automation.
| Metric | Result |
|---|---|
| 🔻 Total Vulnerabilities Reduced | 70% (30 → 9) |
| 💀 Critical Vulnerabilities Resolved | 100% (3 → 0) |
| 🟠 High Severity Reduction | 89% (9 → 1) |
| 🟡 Medium Severity Reduction | 65% (17 → 6) |
[ Policy Draft ] ──► [ Stakeholder Buy-In ] ──► [ Leadership Sign-Off ]
│
▼
[ Maintenance Mode ] ◄── [ Remediate & Verify ] ◄── [ Initial Scan ]
| Phase | Steps | Description |
|---|---|---|
| 📋 Policy | 01–03 | Draft, negotiate, and finalize the VM policy |
| 🔍 Discovery | 04–05 | Negotiate scan access and execute initial authenticated scan |
| ⚡ Remediation | 06–10 | Assess, prioritize, distribute, and execute 4 remediation rounds |
| 🔄 Maintenance | Ongoing | Scheduled scans, patching, and compliance monitoring |
| Tool | Role |
|---|---|
| 🛡️ Tenable | Enterprise vulnerability management — scanning, reporting, and tracking |
| ☁️ Azure Virtual Machines | Hosted Nessus scan engine and simulated Windows Server targets |
| ⚙️ PowerShell & BASH | Automated remediation scripts for patching, hardening, and account management |
- Step 1 — Policy Draft
- Step 2 — Stakeholder Buy-In Meeting
- Step 3 — Policy Finalization & Sign-Off
- Step 4 — Initial Scan Permission Meeting
- Step 5 — Initial Authenticated Scan
- Step 6 — Vulnerability Assessment & Prioritization
- Step 7 — Distributing Remediations
- Step 8 — Post-Scan Review Meeting
- Step 9 — CAB Meeting: Change Approval
- Step 10 — Remediation Execution (4 Rounds)
- First Cycle Summary
- Maintenance Mode
Created an initial policy document outlining program scope, stakeholder responsibilities, and remediation SLA timelines. The draft served as the negotiation baseline before executive sign-off.
Key components of the draft:
- Scope and asset coverage definitions
- Roles and responsibilities by team
- Remediation SLA windows by severity (initial proposal: 48hr for Critical)
- Exceptions and escalation procedures
Presented the draft policy to the server team to assess their ability to meet proposed remediation timelines and gather operational feedback before finalizing the program.
Key outcome:
⏱️ Critical remediation window extended from 48 hours → 1 week based on team capacity constraints — ensuring practical, sustainable adoption.
🎥 Watch: Stakeholder Policy Buy-In Meeting
Revised the policy based on server team feedback. Obtained formal executive signatures to establish program authority and provide compliance backing for future pushback resolution.
Collaborated with the server team to negotiate credentialed scan access. Concerns around scan performance impact on production systems were addressed through a phased approach.
Compromise reached:
- ✅ Scan a single server first to assess resource impact
- ✅ Use just-in-time Active Directory credentials for controlled, auditable access
🎥 Watch: Initial Discovery Scan Meeting
Provisioned an intentionally insecure Windows Server (vm-final-lab-jo) to simulate the server team's environment. Performed a full authenticated Tenable scan and exported results for prioritization.
Summary: 30 Total Vulnerabilities
| Severity | Count |
|---|---|
| 🔴 Critical | 3 |
| 🟠 High | 9 |
| 🟡 Medium | 17 |
| 🟢 Low | 1 |
| Total | 30 |
📄 View All 30 Findings
| Severity | Plugin ID | Finding |
|---|---|---|
| 🔴 Critical | 213824 | Wireshark SEoL (2.2.x) |
| 🔴 Critical | 56710 | Wireshark / Ethereal Unsupported Version Detection |
| 🔴 Critical | 242325 | SQLite < 3.50.2 Memory Corruption |
| 🟠 High | 101898 | Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS |
| 🟠 High | 100671 | Wireshark 2.0.x < 2.0.13 / 2.2.x < 2.2.7 Multiple DoS |
| 🟠 High | 103985 | Wireshark 2.2.x < 2.2.10 Multiple DoS |
| 🟠 High | 97574 | Wireshark 2.0.x < 2.0.11 / 2.2.x < 2.2.5 Multiple DoS |
| 🟠 High | 166555 | WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation |
| 🟠 High | 111387 | Wireshark 2.2.x < 2.2.16 / 2.4.x < 2.4.8 / 2.6.x < 2.6.2 Multiple Vulnerabilities |
| 🟠 High | 10907 | Microsoft Windows Guest Account Belongs to a Group |
| 🟠 High | 102920 | Wireshark 2.2.x < 2.2.9 Multiple DoS |
| 🟠 High | 99437 | Wireshark 2.0.x < 2.0.12 / 2.2.x < 2.2.6 Multiple DoS |
| 🟡 Medium | 57608 | SMB Signing not required |
| 🟡 Medium | 132101 | Windows Speculative Execution Configuration Check |
| 🟡 Medium | 95435 | Wireshark 2.0.x < 2.0.8 / 2.2.x < 2.2.2 Multiple DoS |
| 🟡 Medium | 107093 | Wireshark 2.2.x < 2.2.13 / 2.4.x < 2.4.5 Multiple DoS |
| 🟡 Medium | 105007 | Wireshark 2.2.x < 2.2.11 / 2.4.x < 2.4.3 DoS |
| 🟡 Medium | 96765 | Wireshark 2.0.x < 2.0.10 / 2.2.x < 2.2.4 Multiple DoS |
| 🟡 Medium | 57582 | SSL Self-Signed Certificate |
| 🟡 Medium | 176372 | Wireshark 2.2.x < 2.2.17 Multiple Vulnerabilities |
| 🟡 Medium | 42873 | SSL Medium Strength Cipher Suites Supported (SWEET32) |
| 🟡 Medium | 51192 | SSL Certificate Cannot Be Trusted |
| 🟡 Medium | 104743 | TLS Version 1.0 Protocol Detection |
| 🟡 Medium | 157288 | TLS Version 1.1 Deprecated Protocol |
| 🟡 Medium | 117339 | Wireshark 2.2.x < 2.2.17 / 2.4.x < 2.4.9 / 2.6.x < 2.6.3 Multiple Vulnerabilities |
| 🟡 Medium | 108885 | Wireshark 2.2.x < 2.2.14 / 2.4.x < 2.4.6 Multiple Vulnerabilities |
| 🟡 Medium | 106142 | Wireshark 2.2.x < 2.2.12 / 2.4.x < 2.4.4 DoS |
| 🟡 Medium | 110269 | Wireshark 2.2.x < 2.2.15 / 2.4.x < 2.4.7 / 2.6.x < 2.6.1 Multiple Vulnerabilities |
| 🟡 Medium | 26928 | SSL Weak Cipher Suites Supported |
| 🟢 Low | 10114 | ICMP Timestamp Request Remote Date Disclosure |
Evaluated all 30 findings and established a remediation priority sequence based on risk impact and ease of execution.
| Priority | Category | Findings Affected | Rationale |
|---|---|---|---|
| 1️⃣ | Third-Party Software (Wireshark) | 2 Critical + 7 High + 9 Medium | Highest risk, straightforward removal |
| 2️⃣ | Insecure Protocols & Cipher Suites | TLS 1.0, TLS 1.1, SWEET32, Weak Ciphers | Significant attack surface reduction |
| 3️⃣ | Guest Account Group Membership | Plugin 10907 | Privilege escalation risk |
| 4️⃣ | Windows OS Updates | Remaining OS-level findings | Broad patch coverage |
Packaged and distributed remediation scripts, scan reports, and step-by-step execution instructions to the server team. Prepared the team for formal CAB submission.
Reviewed scan findings alongside the server team. Collectively identified root causes across three key vulnerability clusters and formally submitted remediation packages to the Change Control Board.
Findings Reviewed:
- 📦 Outdated Wireshark installation (end-of-life 2.2.x series) driving the majority of findings
- 🔐 Deprecated TLS 1.0/1.1 protocols and weak SSL cipher suites
- 👤 Guest account incorrectly assigned to local Administrators group
🎥 Watch: Post-Scan Review Meeting
The Change Control Board reviewed and approved the remediation plan. Approval was contingent on rollback scripts being prepared and a tiered deployment approach being followed to protect production stability.
CAB Approval Conditions Met:
- ✅ Rollback scripts prepared for all changes
- ✅ Tiered deployment: test environment first, then production
- ✅ Maintenance window scheduled
Removed all end-of-life Wireshark 2.2.x installations using a PowerShell uninstall script. This single action eliminated 2 Criticals and 7 Highs in one pass.
# remediation-wireshark-uninstall.ps1
# Detects and silently removes outdated Wireshark versionsSummary: 15 Total Vulnerabilities
| Severity | Count | Change from Scan 1 |
|---|---|---|
| 🔴 Critical | 1 | ↓ -2 |
| 🟠 High | 2 | ↓ -7 |
| 🟡 Medium | 10 | ↓ -7 |
| 🟢 Low | 2 | ↑ +1 |
| Total | 15 | ↓ -15 |
📄 View All 15 Findings
| Severity | Plugin ID | Finding |
|---|---|---|
| 🔴 Critical | 242325 | SQLite < 3.50.2 Memory Corruption |
| 🟠 High | 166555 | WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation |
| 🟠 High | 10907 | Microsoft Windows Guest Account Belongs to a Group |
| 🟡 Medium | 57608 | SMB Signing not required |
| 🟡 Medium | 132101 | Windows Speculative Execution Configuration Check |
| 🟡 Medium | 57582 | SSL Self-Signed Certificate |
| 🟡 Medium | 51192 | SSL Certificate Cannot Be Trusted |
| 🟡 Medium | 42873 | SSL Medium Strength Cipher Suites Supported (SWEET32) |
| 🟡 Medium | 242639 | 7-Zip < 25.00 |
| 🟡 Medium | 157288 | TLS Version 1.1 Deprecated Protocol |
| 🟡 Medium | 104743 | TLS Version 1.0 Protocol Detection |
| 🟡 Medium | 214542 | 7-Zip < 24.09 (ZDI-25-045) |
| 🟡 Medium | 26928 | SSL Weak Cipher Suites Supported |
| 🟢 Low | 249179 | 7-Zip < 25.01 |
| 🟢 Low | 10114 | ICMP Timestamp Request Remote Date Disclosure |
Disabled deprecated protocols (TLS 1.0, TLS 1.1, SSLv3) and removed weak cipher suites. CAB-approved rollback script included for safety.
# toggle-protocols.ps1 → Disable insecure TLS/SSL protocols
# toggle-cipher-suites.ps1 → Remove weak cipher suite configurations📁 Protocol Script | Cipher Script
Summary: 10 Total Vulnerabilities
| Severity | Count | Change from Scan 2 |
|---|---|---|
| 🔴 Critical | 0 | ↓ -1 ✅ |
| 🟠 High | 2 | — |
| 🟡 Medium | 6 | ↓ -4 |
| 🟢 Low | 2 | — |
| Total | 10 | ↓ -5 |
📄 View All 10 Findings
| Severity | Plugin ID | Finding |
|---|---|---|
| 🟠 High | 166555 | WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation |
| 🟠 High | 10907 | Microsoft Windows Guest Account Belongs to a Group |
| 🟡 Medium | 57608 | SMB Signing not required |
| 🟡 Medium | 132101 | Windows Speculative Execution Configuration Check |
| 🟡 Medium | 57582 | SSL Self-Signed Certificate |
| 🟡 Medium | 51192 | SSL Certificate Cannot Be Trusted |
| 🟡 Medium | 214542 | 7-Zip < 24.09 (ZDI-25-045) |
| 🟡 Medium | 242639 | 7-Zip < 25.00 |
| 🟢 Low | 249179 | 7-Zip < 25.01 |
| 🟢 Low | 10114 | ICMP Timestamp Request Remote Date Disclosure |
Removed the Guest account from the local Administrators group to close a privilege escalation path. Verification scan confirmed the finding was fully resolved.
# toggle-guest-local-administrators.ps1
# Removes Guest account from local Administrators groupSummary: 9 Total Vulnerabilities
| Severity | Count | Change from Scan 3 |
|---|---|---|
| 🔴 Critical | 0 | — |
| 🟠 High | 1 | ↓ -1 |
| 🟡 Medium | 6 | — |
| 🟢 Low | 2 | — |
| Total | 9 | ↓ -1 |
📄 View All 9 Findings
| Severity | Plugin ID | Finding |
|---|---|---|
| 🟠 High | 166555 | WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation |
| 🟡 Medium | 57608 | SMB Signing not required |
| 🟡 Medium | 132101 | Windows Speculative Execution Configuration Check |
| 🟡 Medium | 57582 | SSL Self-Signed Certificate |
| 🟡 Medium | 51192 | SSL Certificate Cannot Be Trusted |
| 🟡 Medium | 242639 | 7-Zip < 25.00 |
| 🟡 Medium | 214542 | 7-Zip < 24.09 (ZDI-25-045) |
| 🟢 Low | 249179 | 7-Zip < 25.01 |
| 🟢 Low | 10114 | ICMP Timestamp Request Remote Date Disclosure |
Re-enabled Windows Update and applied all outstanding security patches until fully current. Final scan confirmed maintained posture with remaining items flagged for the next remediation cycle.
Summary: 9 Total Vulnerabilities
| Severity | Count | Change from Scan 4 |
|---|---|---|
| 🔴 Critical | 0 | — |
| 🟠 High | 1 | — |
| 🟡 Medium | 6 | — |
| 🟢 Low | 2 | — |
| Total | 9 | Posture maintained |
📄 View All 9 Findings
| Severity | Plugin ID | Finding |
|---|---|---|
| 🟠 High | 166555 | WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation |
| 🟡 Medium | 57608 | SMB Signing not required |
| 🟡 Medium | 132101 | Windows Speculative Execution Configuration Check |
| 🟡 Medium | 57582 | SSL Self-Signed Certificate |
| 🟡 Medium | 51192 | SSL Certificate Cannot Be Trusted |
| 🟡 Medium | 242639 | 7-Zip < 25.00 |
| 🟡 Medium | 214542 | 7-Zip < 24.09 (ZDI-25-045) |
| 🟢 Low | 249179 | 7-Zip < 25.01 |
| 🟢 Low | 10114 | ICMP Timestamp Request Remote Date Disclosure |
| Severity | Scan 1 | Scan 2 | Scan 3 | Scan 4 | Scan 5 | Total Reduction |
|---|---|---|---|---|---|---|
| 🔴 Critical | 3 | 1 | 0 | 0 | 0 | 100% ✅ |
| 🟠 High | 9 | 2 | 2 | 1 | 1 | 89% |
| 🟡 Medium | 17 | 10 | 6 | 6 | 6 | 65% |
| 🟢 Low | 1 | 2 | 2 | 2 | 2 | — |
| Total | 30 | 15 | 10 | 9 | 9 | 70% |
| Round | Action | Before | After | Eliminated |
|---|---|---|---|---|
| R1 | Wireshark Removal | 30 | 15 | 15 findings |
| R2 | Protocols & Ciphers | 15 | 10 | 5 findings |
| R3 | Guest Account | 10 | 9 | 1 finding |
| R4 | Windows OS Updates | 9 | 9 | 0 findings |
Note: The 9 remaining findings represent accepted risk items (SMB signing, SSL certificate trust, speculative execution config, and 7-Zip versioning) queued for the next remediation cycle based on asset criticality and patching schedules.
After completing the initial remediation cycle, the program transitions into Maintenance Mode to ensure sustained security posture over time.
| Activity | Cadence | Description |
|---|---|---|
| 📡 Vulnerability Scans | Weekly / Monthly | Detect new vulnerabilities as systems evolve |
| 🔧 Patch Management | Ongoing | Apply security patches within SLA windows |
| 📋 Remediation Follow-ups | Per finding | Triage, prioritize, and track to closure |
| 📝 Policy Review | Quarterly | Align policy with new threats and regulations |
| ✅ Audit & Compliance | Annually | Internal audits and regulatory evidence gathering |
| 💬 Stakeholder Reporting | Monthly | Program health metrics and trending data |
📄 See the Finalized Policy for full scanning cadence and remediation SLA requirements.