Vulnerability Management Blog
Practical guides on vulnerability prioritization with CVSS, EPSS and CISA KEV, patch management, scanner comparisons, pentesting and compliance evidence.
HSTS Missing From HTTPS Server: How to Enable Strict-Transport-Security on Apache, nginx and IIS
“HSTS missing from HTTPS server” means the web server answers HTTPS requests without a Strict-Transport-Security header, so browsers are never told to…
Ensure gpgcheck Is Globally Activated: How to Fix It on RHEL, Rocky, AlmaLinux and Oracle Linux
“Ensure gpgcheck is globally activated” is a CIS check that fails when DNF or YUM may install RPM packages without verifying their…
Elasticsearch Unrestricted Access (Nessus 101025): How to Enable Authentication with xpack.security.enabled
Elasticsearch Unrestricted Access Information Disclosure (Nessus plugin 101025) means a scanner queried the Elasticsearch REST API, usually on TCP 9200, without any…
How to Encrypt an Existing EBS Volume and Fix Security Hub EC2.3
Security Hub control EC2.3 fails when an EBS volume attached to an EC2 instance is unencrypted. You cannot encrypt an existing EBS…
How to Fix CloudTrail.1: Enable a Multi-Region CloudTrail Trail with Read and Write Management Events
CloudTrail.1 is an AWS Security Hub CSPM control (CIS AWS Foundations 3.1) that fails when an account has no logging multi-Region CloudTrail…
How to Enable BitLocker on All Drives (Fix WN10-00-000030 and WN11-00-000030)
WN10-00-000030 (WN11-00-000030 on Windows 11) is a CAT I DISA STIG check that fails when the operating system drive or any fixed…
Ensure auditd Service Is Enabled: How to Fix It on RHEL and Ubuntu
“Ensure auditd service is enabled” is a CIS Level 2 Linux check that fails when the Linux audit daemon is missing, disabled…
Microsoft .NET Custom Errors Not Set: How to Fix ASP.NET and IIS Detailed Errors
Microsoft .NET Custom Errors Not Set means an IIS server returns ASP.NET’s detailed error page, with stack traces, file paths and version…
Ensure ASLR Is Enabled: How to Set kernel.randomize_va_space = 2 on Linux
“Ensure address space layout randomization (ASLR) is enabled” is a CIS benchmark check that fails when the Linux kernel parameter kernel.randomize_va_space is…
How to Disable xp_cmdshell in SQL Server (VA1059)
VA1059, “xp_cmdshell should be disabled”, means the SQL Server option xp_cmdshell is turned on, so privileged logins can run Windows commands from…