End-to-end vulnerability management program
In this project, a full end to end vulnerability management lifecycle is implemented, simulating a real enterprise environment where no formal process initially exists and progressing to a structured, repeatable remediation program with measurable outcomes.
Inception State: the environment begins in an unmanaged state with vulnerable assets, no defined policy, no scanning cadence, and no formal remediation ownership. Systems include intentionally misconfigured Windows servers with outdated software, insecure protocols, and poor access control practices.
Completion State: a formalised vulnerability management process is established, including defined policy, stakeholder alignment, scheduled scanning, prioritised remediation workflows, and validated reductions in risk through repeated scan cycles.
Technology Utilized
Tenable (vulnerability scanning and reporting platform)
Azure Virtual Machines (scan targets and lab environment)
PowerShell (automation and remediation scripting)
BASH (supporting remediation where applicable)
Table of Contents
Vulnerability Management Policy Draft Creation
Stakeholder Engagement and Policy Buy-In
Policy Finalization and Approval
Scan Authorization and Pilot Testing
Initial Vulnerability Scan Execution
Vulnerability Assessment and Prioritization
Remediation Distribution and Execution
Post-Scan Review and Validation
Change Control and Remediation Approval
Remediation Cycles (Wireshark, Protocols, Accounts, Updates)
Remediation Validation and Metrics
Ongoing Vulnerability Management (Maintenance Mode)
Vulnerability Management Policy Draft Creation
The project begins with the creation of a structured vulnerability management policy defining scope, asset coverage, severity classifications, and remediation timelines. This initial draft establishes a baseline for how vulnerabilities will be identified, prioritised, and resolved across the environment. The policy is intentionally strict at first, enabling later refinement based on operational feedback.
Draft Policy:
1. Policy Overview
This policy establishes the framework for managing vulnerabilities within [COMPANY], IT infrastructure to ensure the security and integrity of our systems through timely and effective identification, evaluation, and remediation of threats.
2. Scope
This policy applies to all IT assets owned or operated by [COMPANY], including networks, servers, endpoints, and associated applications.
3. Responsibilities
- Chief Information Security Officer (CISO): Oversight of the vulnerability management process and ensuring compliance with this policy.
- Chief Information Officer (CIO): Ensuring that vulnerability management is integrated with [COMPANY]’s overall IT strategy.
- Department Heads: Responsible for ensuring compliance within their respective departments.
4. Vulnerability Scan Schedule
- Routine Scans: Conduct monthly scans of all IT assets to identify vulnerabilities.
- Ad-Hoc Scans: Perform scans in response to significant security alerts or when new vulnerabilities are reported.
5. Remediation Schedule and Cadence
Based on the Common Vulnerability Scoring System (CVSS):
- Critical (CVSS 9.0–10): Remediate or mitigate within 48 hours.
- High (CVSS 7.0–8.9): Remediate or mitigate within 7 days.
- Medium (CVSS 4.0–6.9): Remediate or mitigate within 30 days.
- Low (CVSS 0.1–3.9): Remediate or mitigate within 90 days.
6. Maintenance Plans
- Routine Patching: Apply security patches and updates on a scheduled monthly basis.
- Emergency Patching: Initiate within 24 hours for critical vulnerabilities that pose immediate risks.
- Emergency Mitigation: Implement temporary measures (e.g., firewall rules, access restrictions) to protect against vulnerabilities while permanent solutions are developed.
- Unpatchable Assets: Implement segmentation, increased monitoring, or phased removal from the environment.
7. Non-Compliance Consequences
Departments failing to comply with this policy will face:
- Immediate review of their procedures.
- Mandatory retraining for involved personnel.
- Escalation to senior management for further disciplinary actions including termination
8. Sign-Off
Chief Information Security Officer (CISO)
Sign: ____________________________________
Date: ____________________________________
Chief Information Officer (CIO)
Sign: ____________________________________
Date: ____________________________________
Chief Executive Officer (CEO)
Sign: ____________________________________
Date: ____________________________________
9. Review and Revision
This policy will be reviewed annually or sooner if necessary to accommodate changes in business processes or to address emerging threats.
Stakeholder Engagement and Policy Buy-In
A structured discussion is conducted with the server and operations teams to validate feasibility. Key outcomes include adjusting overly aggressive remediation timelines and aligning expectations with available resources. Critical vulnerabilities are redefined with realistic remediation windows, while still allowing accelerated response for actively exploited threats. This phase ensures operational teams are capable of executing the policy rather than being constrained by it.
Policy Finalization and Approval
Following stakeholder feedback, the policy is refined and formally approved. It becomes the governing document for vulnerability management activities, providing authority for enforcement and a reference point for escalation or resistance during remediation efforts.
1. Policy Overview
This policy establishes the framework for managing vulnerabilities within (Company) IT infrastructure to ensure the security and integrity of our systems through timely and effective identification, evaluation, and remediation of threats.
2. Scope
This policy applies to all IT assets owned or operated by (Company), including networks, servers, endpoints, and associated applications.
3. Responsibilities
- Chief Information Security Officer (CISO): Oversight of the vulnerability management process and ensuring compliance with this policy.
- Department Heads: Responsible for ensuring compliance within their respective departments.
- Chief Information Officer (CIO): Ensuring that vulnerability management is integrated with (Company) overall IT strategy.
4. Vulnerability Scan Schedule
- Routine Scans: Conduct monthly scans of all IT assets to identify vulnerabilities.
- Ad-Hoc Scans: Perform scans in response to significant security alerts or when new vulnerabilities are reported.
- A local agent will be used for vulnerability assessment on end-user workstations
5. Remediation Schedule and Cadence
Based on the Common Vulnerability Scoring System (CVSS):
- Critical RCE ZERO DAY (CVSS 9.0–10): Remediate or mitigate within 48 hours.
- Critical (CVSS 9.0–10): Remediate or mitigate within 7 days.
- High (CVSS 7.0–8.9): Remediate or mitigate within 2 weeks.
- Medium (CVSS 4.0–6.9): Remediate or mitigate within 30 days.
- Low (CVSS 0.1–3.9): Remediate or mitigate within 90 days.
6. Maintenance Plans
- Routine Patching: Apply security patches and updates on a scheduled monthly basis.
- Emergency Patching: Initiate within 24 hours for critical vulnerabilities that pose immediate risks.
- Emergency Mitigation: Implement temporary measures (e.g., firewall rules, access restrictions) to protect against vulnerabilities while permanent solutions are developed.
- Unpatchable Assets: Implement segmentation, increased monitoring, or phased removal from the environment.
7. Non-Compliance Consequences
Get Yahya Omer’s stories in your inbox
Join Medium for free to get updates from this writer.
Departments failing to comply with this policy will face:
- Immediate review of their procedures.
- Mandatory retraining for involved personnel.
- Escalation to senior management for further disciplinary actions including termination
8. Sign-Off
Chief Information Security Officer (CISO)
Sign: N/A
Date: 09/04/2026
Chief Information Officer (CIO)
Sign: N/A
Date: 09/04/2026
Chief Executive Officer (CEO)
Sign: N/A
Date: 09/04/2026
9. Review and Revision
This policy will be reviewed annually or sooner if necessary to accommodate changes in business processes or to address emerging threats.
Scan Authorization and Pilot Testing
Before full deployment, a controlled pilot scan is conducted against a single server. This validates scan performance impact, confirms no service disruption, and establishes trust with system owners. Secure credential handling is implemented using a controlled access approach rather than persistent administrative credentials.
Initial Vulnerability Scan Execution
A full authenticated scan is executed across the environment using the configured scan engine. The scan identifies multiple high and critical vulnerabilities, primarily driven by outdated third party software and insecure system configurations.
Scan 1 — Initial Scan
Vulnerability Assessment and Prioritization
Findings are analysed and grouped based on risk and ease of remediation. The prioritisation strategy focuses on achieving maximum risk reduction with minimal operational disruption:
Outdated Third Party Software (Wireshark)
Insecure Protocols and Cipher Suites (TLS/SSL)
Improper Account Privileges (Guest in Administrators)
Missing Windows Updates
This structured prioritisation allows remediation efforts to be executed efficiently and consistently across systems.
Remediation Distribution and Execution
Remediation actions are packaged and distributed to the responsible teams. This includes clear instructions, supporting scripts, and expected outcomes. Standardisation ensures consistent execution across all affected systems.
Remediation Workflow
Initial Scan
Review and Validation
A follow up discussion reviews scan findings and confirms no operational impact from scanning. Key vulnerabilities are analysed, including outdated software, insecure configurations, and unnecessary privileges. Remediation strategies are agreed upon before submission to change control.
Change Control and Remediation Approval
All remediation actions are presented through a controlled approval process. This includes validation of rollback procedures, phased deployment strategies, and risk assessment. Approval ensures changes are implemented safely within production environments.
Remediation Effort:
The server team received remediation scripts and scan reports to address key vulnerabilities. This streamlined their efforts and prepared them for a follow-up review.
Remediation Round 1: Outdated Wireshark Removal
Outdated installations of Wireshark were identified as the primary source of multiple high and critical vulnerabilities. A PowerShell script was developed to automate detection and silent uninstallation across affected systems.
Wireshark Removal Script
A follow up scan confirmed successful removal and elimination of associated vulnerabilities.
Post-Remediation Scan (Wireshark)
Remediation Round 2: Insecure Protocols and Cipher Suites
Legacy protocols including SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 were disabled using PowerShell scripts. Insecure cipher configurations were also removed to align with modern security standards.
Protocol Remediation Script Execution
Insecure Cipher Suite Remediation Script
Systems required a reboot for changes to take effect.
A follow-up scan verified successful remediation, and the results were saved for reference.
Remediation Round 3: Guest Account Group Membership
The local guest account was identified as incorrectly assigned to the administrators group. This was remediated by removing elevated privileges using scripted configuration changes.
Follow up validation confirmed proper access control enforcement, the scan results remained the same as previous.
Remediation Round 4: Windows OS Updates
Systems were updated using standard patch management processes until fully compliant. This resolved remaining vulnerabilities related to outdated system components.
Final Scan Updates
Remediation Validation and Metrics
A final scan cycle was conducted to measure remediation effectiveness. The results demonstrated significant reduction in vulnerabilities across all severity levels:
Critical vulnerabilities fully remediated
High severity vulnerabilities significantly reduced
Medium vulnerabilities reduced through configuration and patching
Overall risk posture improved substantially across the environment
Ongoing Vulnerability Management (Maintenance Mode)
Following the initial remediation cycle, the program transitions into a continuous operational model. Vulnerability management becomes an ongoing process rather than a one time activity.
Key activities include:
Scheduled recurring scans to identify new vulnerabilities
Continuous patch management and system updates
Ongoing remediation aligned to severity and asset criticality
Periodic policy reviews to maintain relevance
Internal audits to ensure compliance
Continued coordination between security and operations teams
This ensures vulnerabilities are consistently identified, prioritised, and remediated, maintaining a stable and secure environment over time.
