Vulnerability Management Blog
Practical guides on vulnerability prioritization with CVSS, EPSS and CISA KEV, patch management, scanner comparisons, pentesting and compliance evidence.
How to Fix “Ensure SELinux Is Not Disabled in Bootloader Configuration”
“Ensure SELinux is not disabled in bootloader configuration” is a CIS benchmark check that fails when a GRUB boot entry passes selinux=0…
Redis Server Unprotected by Password Authentication: How to Fix Nessus 100634
Redis Server Unprotected by Password Authentication (Nessus plugin 100634) means a scanner reached a Redis service, usually on TCP 6379, and could…
How to Enforce readOnlyRootFilesystem for Containers (Kubernetes, ECS, Docker)
The finding Immutable (read-only) root filesystem should be enforced for containers means a container runs without readOnlyRootFilesystem, so its processes can write…
OCSP Stapling Not Offered: How to Enable OCSP Stapling in nginx and Apache
“OCSP stapling not offered” means the HTTPS server does not attach a signed OCSP revocation response to its TLS handshake, so clients…
How to Enable MongoDB Authentication (Nessus Plugin 81777)
MongoDB Service Without Authentication Detection (Nessus plugin 81777) means a scanner reached a MongoDB server, usually on TCP 27017, and ran database…
How to Enable MFA for the AWS Root Account and IAM Users (Security Hub IAM.9, IAM.6, IAM.5)
[IAM.9] means the AWS account root user can sign in with a password but has no MFA device, and [IAM.5] flags IAM…
How to Enforce LDAP Signing on Domain Controllers (PingCastle A-DCLdapSign)
PingCastle’s “A LDAP authentication without signature enforcement was allowed” means a domain controller accepts unsigned LDAP binds, which lets an attacker relay…
How to Enable LDAP Channel Binding on Domain Controllers (LdapEnforceChannelBinding)
PingCastle’s “Channel binding is not enabled for all DC for LDAPS” means a domain controller accepts LDAPS logons without an LDAP channel…
AS-REP Roasting Mitigation: Enable Kerberos Pre-Authentication on AD Accounts
The Nessus finding “AD Starter Scan – Kerberos Pre-authentication Validation” means an Active Directory account has “Do not require Kerberos preauthentication” set,…
How to Enforce IMDSv2 on EC2 Instances (Security Hub EC2.8)
Security Hub control EC2.8 fails when an EC2 instance still accepts IMDSv1 (its HttpTokens setting is optional). To enforce IMDSv2, confirm the…