performing-endpoint-vulnerability-remediation

执行端点漏洞修复

适用场景

在以下情况下使用此技能：

• 修复扫描器（Nessus、Qualys、Rapid7）识别出的漏洞
• 响应需要立即安装补丁的零日 CVE 安全公告
• 满足补丁管理 SLA（严重漏洞在 14 天内修复，高危漏洞在 30 天内修复）
• 根据漏洞扫描结果制定优先级修复计划

请勿将此技能用于漏洞扫描本身（请使用扫描工具），也不要用于应用层漏洞修复（请使用 DevSecOps 流程）。

前提条件

• 漏洞扫描结果（Nessus、Qualys 或 Rapid7 导出的 CSV/XML 格式文件）
• 补丁管理平台（WSUS、SCCM、Intune 或 Automox 等第三方平台）
• 对目标端点或部署基础设施的管理员访问权限
• 用于生产端点补丁安装的变更管理流程
• 用于在生产环境推广前验证补丁的测试环境

工作流

步骤 1：导入并确定漏洞发现的优先级

Priority scoring combines:
1. CVSS Base Score (0-10)
2. EPSS (Exploit Prediction Scoring System) - probability of exploitation
3. CISA KEV (Known Exploited Vulnerabilities) catalog membership
4. Asset criticality (business impact of affected endpoint)
5. Network exposure (internet-facing vs. internal)

Priority Matrix:
  P1 (Critical - 14 days SLA):
    - CVSS >= 9.0 OR
    - Listed in CISA KEV OR
    - Active exploitation in the wild + CVSS >= 7.0

  P2 (High - 30 days SLA):
    - CVSS 7.0-8.9 AND
    - EPSS > 0.5 (50% probability of exploitation)

  P3 (Medium - 60 days SLA):
    - CVSS 4.0-6.9 OR
    - CVSS 7.0-8.9 with EPSS < 0.1

  P4 (Low - 90 days SLA):
    - CVSS < 4.0 AND
    - No known exploit

步骤 2：确定修复措施

针对每个漏洞，确定适当的修复措施：

Remediation Types:
1. Patch: Apply vendor security update (most common)
2. Configuration change: Modify settings to mitigate (registry, GPO)
3. Upgrade: Update to newer software version
4. Workaround: Apply temporary mitigation when patch unavailable
5. Compensating control: Network segmentation, WAF rule, EDR rule
6. Accept risk: Document accepted risk with CISO sign-off

步骤 3：通过 WSUS/SCCM 部署补丁

# WSUS: Approve patches for deployment
# 1. Open WSUS Console
# 2. Navigate to Updates → Security Updates
# 3. Approve selected KBs for target computer groups

# SCCM: Create Software Update Group
# 1. Software Library → Software Updates → All Software Updates
# 2. Select required KBs → Create Software Update Group
# 3. Deploy to target collection with maintenance window

# Intune: Create Windows Update Ring
# Devices → Windows → Update rings
# Configure: Quality updates deferral = 0 days (for critical)
# Feature updates deferral = per policy

# PowerShell: Force Windows Update check
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -KBArticleID "KB5034441" -Install -AcceptAll -AutoReboot

# Verify patch installation
Get-HotFix -Id "KB5034441"
systeminfo | findstr "KB5034441"

步骤 4：应用基于配置的修复措施

# Example: Disable SMBv1 (CVE-2017-0144 - EternalBlue)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

# Example: Disable Print Spooler on non-print servers (CVE-2021-34527 - PrintNightmare)
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Example: Disable LLMNR (credential theft mitigation)
# Via GPO: Computer Configuration → Admin Templates → Network → DNS Client
# Turn off multicast name resolution: Enabled
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" `
  -Name EnableMulticast -Value 0 -PropertyType DWORD -Force

# Example: Restrict NTLM authentication
# Via GPO: Security Settings → Local Policies → Security Options
# Network security: Restrict NTLM: Audit/Deny

步骤 5：处理零日漏洞（暂无可用补丁）

When vendor patch is not yet available:

1. Check vendor advisory for workarounds
   - Microsoft: https://msrc.microsoft.com/update-guide
   - Adobe: https://helpx.adobe.com/security.html
   - Linux: Distribution security trackers

2. Apply temporary mitigations:
   - Disable vulnerable feature/service
   - Deploy EDR detection rule for exploitation attempt
   - Apply network-level blocking (WAF/firewall rules)
   - Restrict access to vulnerable application

3. Monitor for patch release:
   - Subscribe to vendor security mailing list
   - Monitor CISA KEV additions
   - Set calendar reminder for next Patch Tuesday

4. Document workaround with expiration date

步骤 6：验证修复情况

# Re-scan remediated endpoints to confirm vulnerability closure
# Option 1: Targeted vulnerability scan
nessuscli scan --target 192.168.1.0/24 --plugin-id 12345

# Option 2: PowerShell verification
# Check specific KB is installed
$kb = Get-HotFix -Id "KB5034441" -ErrorAction SilentlyContinue
if ($kb) {
    Write-Host "PASS: KB5034441 installed on $(hostname)" -ForegroundColor Green
} else {
    Write-Host "FAIL: KB5034441 missing on $(hostname)" -ForegroundColor Red
}

# Check service is disabled
$svc = Get-Service -Name Spooler
if ($svc.StartType -eq 'Disabled') {
    Write-Host "PASS: Print Spooler disabled" -ForegroundColor Green
}

# Check registry configuration
$val = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
  -Name SMB1 -ErrorAction SilentlyContinue
if ($val.SMB1 -eq 0) {
    Write-Host "PASS: SMBv1 disabled" -ForegroundColor Green
}

步骤 7：报告并跟踪

生成修复状态报告：

Remediation Metrics:
  - Total vulnerabilities: X
  - Remediated: Y (Z%)
  - Pending (within SLA): A
  - Overdue (past SLA): B
  - Accepted risk: C
  - Mean time to remediate (MTTR): D days
  - SLA compliance rate: E%

核心概念

术语	定义
CVSS	通用漏洞评分系统；漏洞严重程度评分范围为 0-10
EPSS	漏洞利用预测评分系统；表示某个 CVE 在未来 30 天内于实际环境中遭到利用的概率（0-1）
CISA KEV	CISA 已知遭利用漏洞目录；联邦机构必须在指定期限内修复其中列出的 CVE
SLA	服务级别协议；根据漏洞严重程度规定修复时限
MTTR	平均修复时间；从发现漏洞到确认修复所需的平均天数
补偿性控制措施	无法直接修复时采用的替代安全措施

工具与系统

• Nessus/Tenable.io：漏洞扫描与修复跟踪
• Qualys VMDR：漏洞管理、检测与响应平台
• Rapid7 InsightVM：提供实时仪表板的漏洞评估工具
• WSUS/SCCM/Intune：Microsoft 补丁部署基础设施
• Automox：适用于 Windows、macOS、Linux 的云原生补丁管理工具
• CISA KEV 目录：https://www.cisa.gov/known-exploited-vulnerabilities-catalog

常见问题

• 未经测试就安装补丁：先将补丁应用到测试组。某些补丁会导致应用兼容性问题或蓝屏死机。
• 忽略 EPSS 评分：EPSS 为 0.01 的 CVSS 9.8 漏洞，紧急程度可能低于 EPSS 为 0.95、正遭到主动利用的 CVSS 7.5 漏洞。
• 未验证修复情况：部署补丁并不保证补丁已成功安装。务必重新扫描以确认漏洞已修复。
• 将关键服务器排除在补丁安装范围之外：那些“无法重启”的服务器会不断积累严重漏洞。请安排维护时段。
• 将所有 CVE 一视同仁：基于风险确定优先级（CVSS + EPSS + 资产关键性 + 暴露程度），比优先修复所有严重漏洞更有效。