Vulnerability Management

Learn about protecting your critical assets with a comprehensive program to defend against malicious threats.

5 Focus Areas for AWS Compliance
Activate Microsoft Defender for Azure SQL Databases
Antivirus Solutions on EC2 Instances
Autoprovisioning of Microsoft Defender for Containers Components.mov
Deploying Security Patches on EC2 Instances
Enable Autoprovisioning of Vulnerability Assessment for Machines
Enable Microsoft Defender for DNS
Enable Microsoft Defender for IoT
Enable Microsoft Defender for Open Source Relationship Databases
Enable Microsoft Defender for SQL Server on Machines
Enable Microsoft Defender for Servers
Ensure Autoprovisioning of the Log Analytics Agent Is Enabled for Azure VMs
Ensure Microsoft Defender Is Enabled for Storage Accounts
Ensure Microsoft Defender Is Enabled for the Azure Resource Manager
Ensure Microsoft Defender for Key Vaults Is Enabled
Ensure the Minimum TLS Version for Storage Accounts Is Set to 1.2
Evaluate Public IP Addresses Regularly
Identifying and Ranking Vulnerabilities in AWS
PCI Requirement 11.1.2 – Unauthorized Wireless Access Points Detection
PCI Requirement 11.2 – Quarterly Internal & External Vulnerability Scans
PCI Requirement 11.2.1 – Perform Quarterly Internal Vulnerability Scans
PCI Requirement 11.2.2 – Perform Quarterly External Vulnerability Scans
PCI Requirement 11.2.3 – Perform Internal and External Scans and Rescans as Needed
PCI Requirement 11.4 – Use Intrusion-Detection and/or Intrusion-Prevention Techniques
PCI Requirement 11.5 – Deploy a Change-Detection Mechanisms to Alert Personnel
PCI Requirement 5.1 – Deploy Anti-Virus Software on all Commonly Affected Systems
PCI Requirement 5.1.1 – Ensure Anti-Virus Programs Detect, Remove and Protect Against Malware
PCI Requirement 5.1.2 – Perform Evaluations to Identify & Evaluate Evolving Malware Threats
PCI Requirement 5.2 – Ensure Anti-Virus Mechanisms are Current, Perform Scans, & Generate Audit Logs
PCI Requirement 5.3 – Ensure Anti-Virus Mechanisms are Active and Can’t be Altered
PCI Requirement 6.1 – Establish a Process to Identify Security Vulnerabilities
PCI Requirement 6.5.6 – All “High Risk” Vulnerabilities
PCI Requirement 6.6 – Address Threats & Vulnerabilities Regularly for Public-Facing Web Applications
PCI v4.0 - 11.1.1: Requirement 11 Polices and Procedures Are In Place
PCI v4.0 - 11.1.2: Requirement 11 Roles and Responsibilities Are In Place
PCI v4.0 - 11.2.1: Wireless Access Points Are Properly Managed
PCI v4.0 - 11.2.2: Maintain Inventory of All Authorized Wireless Access Points
PCI v4.0 - 11.3.1.1: Manage Non-High Risk and Non-Critical Vulnerabilities Appropriately
PCI v4.0 - 11.3.1.2: Use Authenticated Vulnerability Scanning Tools for Internal Scans
PCI v4.0 - 11.3.1.3: Perform Internal Scans After Significant Changes
PCI v4.0 - 11.3.1: Perform Internal Vulnerability Scans Frequently
PCI v4.0 - 11.3.2.1: Perform External Scans After Significant Changes
PCI v4.0 - 11.3.2: Perform External Vulnerability Scans Frequently
PCI v4.0 - 11.5.1.1: Detect Alert and Address Covert Malware Communication Channels
PCI v4.0 - 11.5.2: Deploy a Change-Detection Mechanism
PCI v4.0 - 11.6.1: Change-Detection or Tamper-Detection Mechanisms Are Deployed on Payment Pages
PCI v4.0 - 5.1.1: Have Requirement 5 Policies and Procedures In Place
PCI v4.0 - 5.1.2: Have Requirement 5 Roles and Responsibilities In Place
PCI v4.0 - 5.2.1: Deploy Anti-Malware Solutions on All System Components
PCI v4.0 - 5.2.2: Utilize Sufficient Anti-Malware Solutions
PCI v4.0 - 5.2.3.1: Define Frequency of Periodic Evaluations of Systems in the Targeted Risk Analysis
PCI v4.0 - 5.2.3: Periodically Review Systems Not Protected by Anti-Malware Solutions
PCI v4.0 - 5.3.1: Keep Anti-Malware Solutions Up to Date
PCI v4.0 - 5.3.2.1: Define Frequency of Anti-Malware Scans in Targeted Risk Analysis
PCI v4.0 - 5.3.2: Ensure Anti-Malware Solution Performs Scans or Continuous Behavior Analyses
PCI v4.0 - 5.3.3: Utilize Anti-Malware Solutions for Removable Media
PCI v4.0 - 5.3.4: Enable and Retain Audit Logs for Anti-Malware Solutions
PCI v4.0 - 5.3.5: Do Not Allow Anti-Malware Solutions to Be Altered or Disabled
PCI v4.0 - 5.4.1: Have Protections in Place to Prevent Phishing Attacks
PCI v4.0 - 6.1.1: Requirement 6 Policies and Procedures Are In Place
PCI v4.0 - 6.1.2: Requirement 6 Roles and Responsibilities Are In Place
PCI v4.0 - 6.2.1: Bespoke and Custom Software Are Developed Securely
PCI v4.0 - 6.2.2: Train Personnel Developing Custom Software in Secure Software Practices
PCI v4.0 - 6.2.3 & 6.2.3.1: Bespoke and Custom Software Is Reviewed Before Being Released
PCI v4.0 - 6.2.4: Utilize Software Engineering Techniques to Secure Bespoke and Custom Software
PCI v4.0 - 6.3.1: Identify Security Vulnerabilities in Software
PCI v4.0 - 6.3.2: Maintain a List of Bespoke and Custom and Third-Party Software
PCI v4.0 - 6.3.3: Remediate Known Vulnerabilities Through Security Patches
PCI v4.0 - 6.4.1: Protect Public-Facing Web Applications
PCI v4.0 - 6.4.2: Use an Automated Solution to Protect Public-Facing Web Applications
PCI v4.0 - 6.4.3: Payment Page Scripts Are Managed Properly
PCI v4.0 - 6.5.1: Have a Documented Change Process for All System Components
PCI v4.0 - 6.5.2: Ensure Applicable PCI DSS Requirements Are In Place After Significant Changes
PCI v4.0 - 6.5.3: Pre-Production and Production Environments Are Separated
PCI v4.0 - 6.5.4: Separate Duties Between Production and Pre-Production Environments
PCI v4.0 - 6.5.5: Live Primary Account Numbers Are Not Used In Pre-Production Environments
PCI v4.0 - 6.5.6: Ensure Test Data and Accounts Are Removed Before Going into Production
Running Vulnerability Scans After a Significant Change
SOC 2 Academy: Performing Daily Log Reviews
Shared Responsibility Matrix in PCI
Testing for Unauthorized Wireless Access Points
The Value of Quarterly Internal Vulnerability Scans
Using Systems Manager from a Service-Linked Role
Using VPC Endpoints to Access Systems Manager
Utilize Microsoft Defender for Azure Cosmos DB
Verify that Microsoft Defender is Enabled for Containers

Partner with us

Our information security auditors are ready to assist you with your compliance challenges. Schedule an appointment with our certified specialists to get the conversation started!

Connect with a Live Expert