This project walks through a full simulation of building a vulnerability management program from the ground up. Starting with no policy in place, and ending with a fully functional and tested remediation cycle.
- Starting Point: No existing vulnerability management framework or policy.
- Final Outcome: A formal policy is rolled out, stakeholder alignment is achieved, and a full remediation lifecycle is completed across the environment.
- Tenable – Enterprise vulnerability management (Nessus for scanning)
- Azure VMs – Scan targets and scan engine host
- PowerShell & Bash – Custom remediation scripting
- Vulnerability Management Policy Draft Creation
- Mock Meeting: Policy Buy-In (Stakeholders)
- Policy Finalization and Senior Leadership Sign-Off
- Mock Meeting: Initial Scan Permission (Server Team)
- Initial Scan of Server Team Assets
- Vulnerability Assessment and Prioritization
- Distributing Remediations to Remediation Teams
- Mock Meeting: Post-Initial Discovery Scan (Server Team)
- Mock CAB Meeting: Implementing Remediations
- Remediation Round 1: Outdated Wireshark Removal
- Remediation Round 2: Insecure Protocols & Ciphers
- Remediation Round 3: Guest Account Group Membership
- Remediation Round 4: Windows OS Updates
- Remediation Round 5: Certificate Trust Bypass (CVE-2013-3900)
- First Cycle Remediation Effort Summary
- Special Thanks
This phase focuses on drafting a Vulnerability Management Policy as a starting point for stakeholder engagement. The initial draft outlines scope, responsibilities, and remediation timelines, and may be adjusted based on feedback from relevant departments to ensure practical implementation before final approval by upper management.
Draft Policy
In this phase, a meeting with the server team introduces the draft Vulnerability Management Policy and assesses their capability to meet remediation timelines. Feedback leads to adjustments, like extending the critical remediation window from 48 hours to one week, ensuring collaborative implementation.
YouTube Video: Stakeholder Policy Buy-In Meeting
After gathering feedback from the server team, the policy is revised, addressing aggressive remediation timelines. With final approval from upper management, the policy now guides the program, ensuring compliance and reference for pushback resolution.
Finalized Policy
The team collaborates with the server team to initiate scheduled credential scans. A compromise is reached to scan a single server first, monitoring resource impact, and using just-in-time Active Directory credentials for secure, controlled access.
YouTube Video: Initial Discovery Scan
In this phase, an insecure Windows Server is provisioned to simulate the server team's environment. After creating vulnerabilities, an authenticated scan is performed, and the results are exported for future remediation steps.
We assessed vulnerabilities and established a remediation prioritization strategy based on ease of remediation and impact. The following priorities were set:
- Third Party Software Removal (Wireshark)
- Windows OS Secure Configuration (Protocols & Ciphers)
- Windows OS Secure Configuration (Guest Account Group Membership)
- Windows OS Updates
- Windows OS Secure Configuration (WinVerifyTrust Signature Padding Check & SMB Signing Enforcement)
The server team received remediation scripts and scan reports to address key vulnerabilities. This streamlined their efforts and prepared them for a follow-up review.
The server team reviewed vulnerability scan results, identifying outdated software, insecure accounts, and deprecated protocols. The remediation packages were prepared for submission to the Change Control Board (CAB).
The Change Control Board (CAB) reviewed and approved the plan to remove insecure protocols and cipher suites. The plan included a rollback script and a tiered deployment approach.
The server team used a PowerShell script to remove outdated Wireshark. A follow-up scan confirmed successful remediation.
Wireshark Removal Script
Scan 2 - Third Party Software Removal
The server team used PowerShell scripts to remediate insecure protocols and cipher suites. A follow-up scan verified successful remediation, and the results were saved for reference.
PowerShell: Insecure Protocols Remediation
PowerShell: Insecure Ciphers Remediation
Scan 3 - Ciphersuites and Protocols
The server team removed the guest account from the administrator group. A new scan confirmed remediation, and the results were exported for comparison.
PowerShell: Guest Account Group Membership Remediation
Scan 4 - Guest Account Group Removal
Windows updates were re-enabled and applied until the system was fully up to date. A follow-up scan verified the changes, in preperation for the final round.
The server team used PowerShell scripts to apply the CVE-2013-3900 registry mitigation and enforce SMB signing via local policy configuration. A final scan verified successful remediation, and the results were saved for reference.
PowerShell: CVE-2013-3900 Mitigation
PowerShell: SMB Signing Enforcement
Scan 6 - CVE-2013-3900 Patch & SMB Fix
The remediation process reduced total vulnerabilities by 87%, from 30 in Scan 1 to 4 in Scan 6.
- Critical vulnerabilities were eliminated entirely by Scan 2 (100% reduction).
- High vulnerabilities dropped by 90%, from 10 to 1.
- Medium vulnerabilities were reduced by 82%, from 17 to 3.
- Low vulnerabilities remained constant, with 1 identified in each scan.
This trend demonstrates effective remediation across multiple severity levels. In a production environment, asset criticality and risk tolerance would further guide prioritization in future cycles.
After completing the initial remediation cycle, the vulnerability management program transitions into Maintenance Mode. This phase ensures that vulnerabilities continue to be managed proactively, keeping systems secure over time. Regular scans, continuous monitoring, and timely remediation are crucial components of this phase. (See Finalized Policy for scanning and remediation cadence requirements.)
Key activities in Maintenance Mode include:
- Scheduled Vulnerability Scans: Perform regular scans (e.g., weekly or monthly) to detect new vulnerabilities as systems evolve.
- Patch Management: Continuously apply security patches and updates, ensuring no critical vulnerabilities remain unpatched.
- Remediation Follow-ups: Address newly identified vulnerabilities promptly, prioritizing based on risk and impact.
- Policy Review and Updates: Periodically review the Vulnerability Management Policy to ensure it aligns with the latest security best practices and organizational needs.
- Audit and Compliance: Conduct internal audits to ensure compliance with the vulnerability management policy and external regulations.
- Ongoing Communication with Stakeholders: Maintain open communication with teams responsible for remediation, ensuring efficient coordination.
By maintaining an active vulnerability management process, organizations can stay ahead of emerging threats and ensure long-term security resilience.
- Josh Madakor for creating the Cyber Range which this project was a part of.
- Ibrahim Hefzulla for participating in the mock meetings.
- Zain Hilal for participating in the mock meetings.
- Sultan for participating in the mock meetings.