RemediationGuidance

Cortex Attack Surface Management plain_text

Details

ID	`RemediationGuidance`
Type	plain_text
From Version	6.5.0
Truncated	No

[
{
"issueTypeId": "AcclaimSystemsUSAHERDS",
"remediationGuidance": "USAHERDS has been the target of aggressive attack campaigns by Chinese espionage group APT41 and, since it’s a valuable entrypoint into government systems, malicious actors may attempt exploiting instances of this product that are publicly exposed.\n\nXpanse recommends securing your organization’s instances of USAHERDS by taking the following steps:\n\n1. Verify whether it is necessary for USAHERDS to be publicly accessible on the internet. Should it be deemed necesary to have public exposure, then it is considered a best practice to place assets behind a Web Application Firewall (WAF).\n2. Confirm which version of USAHERDS is running on your asset. Any version before 7.4.0.1 (inclusive) is vulnerable to CVE-2021-44207 and could lead to remote code execution from malicious actors. If you are running a vulnerable version, upgrading to the latest version is strongly recommended."
},
{
"issueTypeId": "AdobeColdFusion",
"remediationGuidance": "Adobe ColdFusion is vulnerable to authentication bypass and remote code execution vulnerabilities, such as https://nvd.nist.gov/vuln/detail/CVE-2023-26360 and https://nvd.nist.gov/vuln/detail/CVE-2023-38203, and has been frequently exploited in the wild. Motivated attackers could gain unauthorized access to instances of Adobe ColdFusion and may have visibility of all applications managed by the exploited ColdFusion instance.\n\nXpanse recommends running only the latest version of ColdFusion and applying security patches as soon as they become available. Ideally, access to ColdFusion devices would be protected by a secure access gateway or proxy to prevent unauthorized access."
},
{
"issueTypeId": "AdobeCommerce",
"remediationGuidance": "To secure Adobe Commerce instances, it is recommended to perform the following:\n\n1. Isolate Adobe Commerce instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Adobe Commerce instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Adobe Commerce instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Adobe Commerce instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "AdobeFlash",
"remediationGuidance": "1. Best practice is to not expose end of life (EOL) software to the internet.\n2. Evaluate all devices utilizing Adobe Flash Player and where possible remove all existing Adobe Flash Player installations. https://www.adobe.com/products/flashplayer/end-of-life.html"
},
{
"issueTypeId": "AjpServer",
"remediationGuidance": "The Apache JServ Protocol (AJP) is a protocol that can proxy inbound requests from a web server to an application server that sits behind the web server. AJP should never be exposed to the internet.\n\n1. Identify the exposed server running AJP and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Secure the network by blocking outbound AJP on TCP port 8009.\n3. It is recommended to define the strong secret key attribute requiredSecret in server.xml. This sets AJP protocol authentication credentials and ensures that only requests from authenticated workers will be honored\n4. Any instance of Apache Tomcat server should be updated to the latest version which will also update AJP.\n5. AJP / Tomcat server security best practices can be followed https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html."
},
{
"issueTypeId": "AmazonSimpleStorageService",
"remediationGuidance": "Security best practices for Amazon S3 can be found https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html."
},
{
"issueTypeId": "AmcrestTechnologiesCamera",
"remediationGuidance": "As per CVE-2020-5735, Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code. Further assessment is needed by organizations to infer vulnerability since this policy does not detect models, versions, custom configurations, workarounds, or patches that remediate the vulnerability."
},
{
"issueTypeId": "AMIMegaRACBMC",
"remediationGuidance": "MegaRAC should not be exposed to the public internet. Threat actors who gain access to MegaRAC would be able to monitor and alter network devices. In order to protect your network, consider the following steps:\n\n1. Disconnect MegaRAC from the public facing internet.\n2. Place the server behind a secure VPN, and limit access to approved server administrators.\n3. Change all the default passwords. By default, AMI MegaRAC BMC servers come with the default username and password admin:password. Change these credentials to strong, unique passwords that are hard to guess.\n4. Check if there are any firmware updates available for the BMC and apply them. This will help to patch any known vulnerabilities."
},
{
"issueTypeId": "ApacheAirflow",
"remediationGuidance": "To secure Apache Airflow instances, it is recommended to perform the following:\n\n1. Isolate Apache Airflow instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Apache Airflow instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Apache Airflow instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Apache Airflow instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ApacheAPISIX",
"remediationGuidance": "Apache APISIX is known to be vulnerable to authentication bypass and remote code execution attacks, most notably https://nvd.nist.gov/vuln/detail/cve-2022-24112, which could lead to malicious actors gaining access to the admin dashboard interface. These types of attacks could allow unauthorized users to bring services offline and/or extract critical information about an organization’s infrastructure.\n\nXpanse recommends securing instances of Apache APISIX by following these best practices:\n\n1. Place Apache APISIX gateways behind a web application firewall (WAF) and ensure that there are comprehensive rules in place to restrict access only to intended audiences.\n\n2. Ensure that Apache APISIX gateways are running on the latest version and implement a patch management process to facilitate applying security updates in a timely manner.\n\n3. Implement rate-limiting to prevent traffic overload and Distributed Denial of Service (DDoS) attacks.\n\n4. Enable robust logging and closely monitor ingress and egress traffic."
},
{
"issueTypeId": "ApacheCoyote",
"remediationGuidance": "Evaluate whether or not this device should be exposed to the public internet. If it is determined that this device should not be exposed to the public internet, identify the asset owner and work with them to remove the device from being publicly accessible.\n\nIf this device needs to be exposed to the public internet, it is recommended to put the device behind security tooling such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled.\n\nMore information regarding Apache Tomcat and Apache Coyote security configurations can be found https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html."
},
{
"issueTypeId": "ApacheDruid",
"remediationGuidance": "It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\n\nXpanse recommends securing your database software by taking the following steps:\n\n1. Isolate the database from the public internet by placing it behind a VPN.\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ApacheSuperset",
"remediationGuidance": "If you have identified a vulnerable exposed instance of Apache Superset, there are several steps you can take to remediate the issue:\n\n1. Determine the nature and severity of the vulnerability.\n2. Quarantine or isolate the system from the network to prevent further damage and to protect other systems from being affected.\n3. If a patch or update is available, apply it to the system as soon as possible. This will help to fix the vulnerability and prevent further exploitation.\n4. Conduct a thorough security audit of the system to identify any other potential vulnerabilities or weaknesses that may have been exploited.\n5. Take all necessary steps to eradicate any threat discovered on the system.\n6. Monitor the system for any signs of continued exploitation or suspicious activity.\n7. Follow best practices for securing Apache Superset, such as limiting access to the system, using secure configurations, and regularly reviewing logs and audit trails.\n\nFor additional information see this https://superset.apache.org/docs/security/"
},
{
"issueTypeId": "AppleCups",
"remediationGuidance": "1. CUPS servers should not be directly accessible from the internet as they pose a significant risk as vulnerabilities are constantly being found for the service. Evaluate if this CUPS server needs to be exposed to the public internet for business purposes.\n2. If the server does need to be exposed to the public internet or an internal network, Xpanse recommends reconfiguring the server to leverage the Internet Printing Protocol (IPP) along with Access Control Lists (ACL), authentication, and encrypted communication.\n3. Configuration of secure IPP can be found https://www.rfc-editor.org/rfc/rfc7472.html.\n4. Update to the latest secure version."
},
{
"issueTypeId": "AraknisNetworks300SeriesRouter",
"remediationGuidance": "If your Araknis Networks 300 series router is found to be exposed take the following steps to remediate:\n\n1. Isolate the router from the network to prevent any further damage or compromise.\n2. Assess the extent of the exposure by reviewing logs and conducting a vulnerability scan. Based on the findings, the following steps can be taken to remediate the exposure:\n\n1. Change the default login credentials: If the router is exposed due to the default credentials being left unchanged, the first step would be to change the password to a strong and unique one.\n2. Update the firmware: Ensure that the router is running on the latest firmware version, which often includes security patches and bug fixes.\n3. Review the firewall rules: Check the firewall rules to ensure that only necessary ports are open and that the router is not accessible from the internet.\n4. Disable unnecessary services: Disable any unnecessary services or features that are not being used, as they can increase the attack surface.\n5. Implement network segmentation: Implement network segmentation to limit the impact of an attack on the router.\n6. Monitor for any unusual activity: Implement continuous monitoring to detect any unusual activity or anomalies that may indicate a compromise.\n7. Conduct regular vulnerability assessments: Regularly assess the security posture of the router to ensure that it is protected against the latest threats and vulnerabilities."
},
{
"issueTypeId": "ArcadyanBuffaloRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "ArubaAirWave",
"remediationGuidance": "Due to the network management access provided by Aruba AirWave, it is recommended that instances of Aruba AirWave are not accessible to the public internet unless there is a clear business need. If the instance must be publicly accessible, follow the vendor security deployment documents. For example, the AirWave 8.2.14.0 documentation can be found https://www.arubanetworks.com/techdocs/AirWave/82140/AirWave_8.2.14.0_Security_Deployment_Guide.pdf.\n\nIt may also be valuable to track the newest vulnerabilities on the https://www.arubanetworks.com/support-services/security-bulletins/ webpage."
},
{
"issueTypeId": "AssetOnUnapprovedProvider",
"remediationGuidance": "Assets discovered on unapproved providers should be removed from that provider or decommissioned immediately. If that is not an option, the compliance team at your organization should work to certify the provider so that your organization remains compliant. Consider exploring how the asset ended up being hosted with an unauthorized provider and develop processes to prevent future occurrences."
},
{
"issueTypeId": "ASUSRouter",
"remediationGuidance": "It is recommended to evaluate whether or not this asset should be exposed to the internet.\nIf it is determined that the device should not be publicly exposed, identify the asset owner and work with them to remove the device from being accessible to the internet."
},
{
"issueTypeId": "AtlassianBitbucket",
"remediationGuidance": "Bitbucket is known to have been https://jira.atlassian.com/browse/BSERV-13438 with attackers being able to perform remote code execution. Xpanse recommends Bitbucket deployments are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities."
},
{
"issueTypeId": "AtlassianCrucible",
"remediationGuidance": "Determine whether this asset should be exposed to the public internet or not.\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible."
},
{
"issueTypeId": "AtlassianFisheye",
"remediationGuidance": "Determine whether this asset should be exposed to the public internet or not.\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible."
},
{
"issueTypeId": "AtlassianJiraServer",
"remediationGuidance": "Evaluate whether the JIRA Server must be accessible on the public internet. JIRA servers that contain sensitive information should remain on internal networks. If a JIRA server must be publicly available, adhere to the following best practices:\n\n1. Require all accounts to use MFA.\n2. Refuse anonymous user access. This will require all users to be logged in to view data.\n3. Take a least privilege approach when determining which access different user groups should have.\n4. Stay up to date with the latest Attlasian Security Advisories: https://confluence.atlassian.com/jira/security-advisories-112853939.html"
},
{
"issueTypeId": "AtlassianJiraServiceManagement",
"remediationGuidance": "If you have discovered an exposed and vulnerable instance of Jira Service Management, you should take the following steps to remediate the vulnerability:\n\n1. Quarantine the vulnerable server/application to prevent further potential exploits, lateral movement, data loss, or footholds in your environment.\n2. Identify the specific vulnerability affecting the instance of Jira Service Management.\n3. Once you have identified the vulnerability, apply any available patches or updates to the instance of Jira Service Management to remediate the vulnerability.\n4. Ensure that the instance of Jira Service Management is configured with appropriate security settings, such as SSL encryption, two-factor authentication, and access controls.\n5. Review logs associated with the device to include network logs, application logs, IPS/IDS logs, EDR logs, OS logs, etc. to determine if any compromise as a result of the vulnerable asset took place. Then contain, eradicate, and remediate appropriately.\n6. Continue to monitor all instances of Jira Service Management for future vulnerabilities and apply patches and updates as necessary to ensure ongoing proficient security."
},
{
"issueTypeId": "AvePointFly",
"remediationGuidance": "Successful exploitation of AvePoint Fly servers could give malicious actors access to PII data or sensitive details about critical infrastructure that may be used as leverage in more sophisticated attacks.\n\nXpanse recommends minimizing network exposures for AvePoint Fly servers by ensuring they are not publicly exposed on the internet and are only accessible through a VPN if remote access is required."
},
{
"issueTypeId": "BarracudaEmailSecurityGateway",
"remediationGuidance": "If an attacker gains access to an exposed Barracuda Email Security Gateway they can potentially intercept, read, and modify emails, bypass security filters, inject malware or phishing links, steal sensitive data, disrupt email services, and compromise the organization&#39;s overall email security and communication integrity. \n\nTo remediate devices affected by CVE-2023-2868, the vendor recommends that impacted ESG appliances must be immediately replaced regardless of patch version level.\nFor information regarding CVE-2023-2868, please refer to the following resources:\n1. https://www.barracuda.com/company/legal/esg-vulnerability\n2. https://status.barracuda.com/incidents/34kx82j5n4q9\n3. https://nvd.nist.gov/vuln/detail/CVE-2023-2868\n\nFor security recommendations that do not involve CVE-2023-2868, it is recommended to perform the following:\n1. Implement network access controls and firewall rules to limit access to the Barracuda Email Security Gateway only to authorized IP addresses and users.\n2. Regularly update the firmware and software of the Barracuda Email Security Gateway to ensure it has the latest security patches and protection against known vulnerabilities.\n3. Enable multi-factor authentication (MFA) and enforce strong, unique passwords for all user accounts accessing the gateway.\n4. Continuously monitor the gateway for any suspicious activity, and enable logging to detect and analyze potential security incidents.\n5. Periodically review and validate the gateway&#39;s security configurations, ensuring they adhere to the organization&#39;s security policies and industry best practices."
},
{
"issueTypeId": "BlueimpjQueryFileUpload",
"remediationGuidance": "Blueimp jQuery File Upload is highly insecure and vulnerable to unrestricted file upload vulnerabilities like **CVE-2018-9206**. Successful exploitation could lead to attackers performing remote code execution through malicious file uploads.\n\nDue to the ease of exploitation and the widget being officially end-of-life, no configuration of jQuery File Upload is considered safe. Xpanse recommends removing this widget from your organization’s websites."
},
{
"issueTypeId": "Bod1801NonCompliantWebServer",
"remediationGuidance": "1. Best practice is to remove support for known-weak cryptographic protocols and ciphers.\n2. Evaluate if there is any PII or sensitive information on the web server to understand the impact. Identify all versions of SSL/TLS and corresponding ciphers.\n3. Follow the guidance set forth by CISA to ensure weak protocols and ciphers have been updated to the approved versions. https://www.cisa.gov/binding-operational-directive-18-01"
},
{
"issueTypeId": "Bod1801NonCompliantWebServerInsecureTLSCipher",
"remediationGuidance": "The weak or disallowed algorithms flagged by this policy are easily exploitable, and supporting them could lead to sensitive data leaks. These cipher suites should be disabled in favor of cryptographic algorithms that are considered secure, like SHA256, SHA384, SHA512, and ECDSA."
},
{
"issueTypeId": "Bod1801NonCompliantWebServerInsecureTLSVersion",
"remediationGuidance": "The SSL/TLS versions flagged by this policy are famously insecure and increasingly less supported by modern browsers. The exploitation of these protocols could lead to attacks such as Padding Oracle On Downgraded Legacy Encryption (POODLE), Browser Exploit Against SSL/TLS (BEAST), and Compression Ratio Info-leak Made Easy (CRIME), which could lead to critical data leaks.\n\nComplying with BOD 18-01 directives requires disabling TLS 1.0, SSL 2.0, and SSL 3.0."
},
{
"issueTypeId": "Bod1801NonCompliantWebServerInvalidHSTS",
"remediationGuidance": "When STS is not configured, threat actors can run SSL stripping attacks, making all web connections unencrypted. It is recommended to enable HTTP Strict Transport Security (HSTS) by following these steps:\n\n1. Add a Strict-Transport-Security response header to your application with the value: max-age&#61;31536000. This will inform the browser that it should not allow that web application to be accessed over HTTP during the configured time. The max age should be set to at least one year.\n2. Add the includeSubDomains flag, which will enforce HSTS at the subdomain level.\n3. Consider submitting your application’s domain to preload lists. Preloading is not a hard requirement, but preloading will prevent SSL stripping attacks on first use. Preloading may not be a feasible solution if any subdomains are expected to function over HTTP, as it will make those subdomains inaccessible.\n\nFurther documentation: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html."
},
{
"issueTypeId": "BoxStorage",
"remediationGuidance": "Instances of Box Storage that are unpatched or misconfigured pose a serious security risk to your organization.\n\nEnsure you are running the latest version and use security best practices to restrict access to the application.\n\nBest practices include, but are not limited to:\n* Utilizing MFA\n* Placing access to the application behind security devices\n* Monitoring for nefarious activity targeting Box Storage\n\nBox Storage does not currently have any registered CVEs, but security researchers have discovered security flaws in the software including the ability to bypass MFA."
},
{
"issueTypeId": "BuildingControlSystem",
"remediationGuidance": "Successful attacks against building control systems could significantly impact human health and safety and could lead to infrastructure and environmental damage. These types of breaches usually happen when building control systems are publicly exposed and don’t have robust authentication, encryption, and access controls in place, either due to a lack of proper configuration, legacy protocols, or end-of-life versions that do not provide sufficient security features.\n\nXpanse recommends securing assets surfaced by this policy by performing the following:\n\n1. Minimize network exposure by deploying building control systems behind a firewall and ensure they are not accessible from the public internet. Block unauthorized traffic and regularly monitor network traffic.\n2. When remote access is required, further limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system and that access is granted on a need-to-know basis to mitigate the risk of insider threats.\n3. All building control sub-systems’ networks should be segregated from one another to prevent an intruder from traversing the networking and gaining full infrastructure access.\n4. Implement multi-factor authentication to prevent unauthorized access and enforce robust password policies.\n5. Keep all software employed by building control systems up to date by regularly applying patches and updates to address known vulnerabilities."
},
{
"issueTypeId": "CactiNetworkMonitoringTool",
"remediationGuidance": "Since this tool allows access to logs for various devices, it is recommended to have this interface only available to the internal network and not be internet facing. \n1. Identify the device / asset owner and discuss whether there is a business need for the interface to be internet facing.\n2. If it is determined that the device must be internet facing due to business requirements, ensure it is placed behind security tooling such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled."
},
{
"issueTypeId": "CentOSWebPanel",
"remediationGuidance": "CentOS Web Panel (CWP) is frequently vulnerable to remote code execution attacks, the most recent example being https://nvd.nist.gov/vuln/detail/CVE-2022-44877, so staying up-to-date on patching is critical.\n\nXpanse recommends reviewing the results surfaced by this policy to determine whether your organization is running a version of CWP before 0.9.8.1147. Since https://nvd.nist.gov/vuln/detail/CVE-2022-44877 does not require a sophisticated attack, and it is currently exploited in the wild, it is imperative to update CWP to the latest version.\n\nThe default installation of CWP comes with automatic patching, and, if possible, it is strongly encouraged that this functionality is enabled at all times. CWP is known for quickly addressing security vulnerabilities, and automatic security updates are published often before public vulnerability disclosure, so using this feature is essential in securing your environment."
},
{
"issueTypeId": "CertificateFromUnapprovedIssuer",
"remediationGuidance": "Certificates discovered from unapproved issuers should be revoked from your SSL domain immediately. Consider exploring how the certificate was issued from an unauthorized issuer and develop processes to prevent future occurrences. To request a new certificate you will need to generate a Certificate Signing Request, submit it to an authorized issuer, and then install the certificate on your domain."
},
{
"issueTypeId": "CertificateInCertificateChainExpiringSoon",
"remediationGuidance": "Expired certificates can lead to catastrophic errors. Most browsers will display warnings if a user attempts to access a website with expired certificates. Certain programs and APIs will throw errors if they try interfacing with websites with expired certificates.\n\nIt is recommended to work with the asset owner to renew the expired certificate(s) and implement a strategy to prevent expiry in the future."
},
{
"issueTypeId": "CertificateNameMismatch",
"remediationGuidance": "A certificate name mismatch indicates that the website a user is visiting may be fraudulent. In order to ensure access to the service, update the subject alternative names to include the correct domain name.\n\nCertain browsers such as https://developer.chrome.com/blog/chrome-58-deprecations/#remove-support-for-commonname-matching-in-certificates no longer check the common name field, so only updating the common name may still cause errors. Details on certificate naming standards can be found in https://datatracker.ietf.org/doc/html/rfc2818#section-3.1."
},
{
"issueTypeId": "CheckboxSurvey",
"remediationGuidance": "If an attacker gains access to an exposed Checkbox Survey server they can potentially manipulate and compromise sensitive data including survey responses, user information, and survey designs. The attacker may also disrupt the survey process by altering or deleting surveys, impersonating legitimate users, and launching further attacks against connected systems. This could lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization using the Checkbox Survey server.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the Checkbox Survey server from the public internet by placing it behind a firewall, allowing only necessary traffic to reach the server through network segmentation.\n2. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to restrict access to the server only to authorized personnel.\n3. Ensure that the Checkbox Survey software and underlying server components are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n4. Enable encryption for data transmission (e.g., HTTPS) and storage (e.g., database encryption) to protect sensitive data from unauthorized access and tampering.\n5. Employ monitoring and intrusion detection tools to identify and respond to any suspicious activities or potential security breaches on the Checkbox Survey server. Regularly review access logs and server configurations to ensure security best practices are being followed."
},
{
"issueTypeId": "CircleCI",
"remediationGuidance": "An unpatched and misconfigured instance of CircleCI poses a serious security risk to any organization.\n\n1. If your organization&#39;s CircleCI instance must be public facing due to remote developers or admins place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\n2. Another method that can offer secure access to assets on prem would to utilize a VPN to offer remote access.\n3. Ensure monitoring is configured to detect activities such as unauthorized access or exploit attempts."
},
{
"issueTypeId": "CiscoAdaptiveSecurityAppliance",
"remediationGuidance": "Unpatched or misconfigured Cisco ASA devices pose a serious security risk due to 115&#43; public CVEs associated with the devices. The CVEs cover a large number of issues such as remote code execution, DoS, and authentication bypasses.\n\n1. Ensure your organization is running the latest updates for your Cisco ASAs to prevent known/active exploits from being successfully ran against your devices.\n2. Never place admin logins for devices on a public facing asset.\n3. Enable robust application and server logging to monitor for nefarious activities."
},
{
"issueTypeId": "CiscoDuoSSO",
"remediationGuidance": "Cisco Duo SSO is known to be vulnerable to sophisticated attacks from known threat actors. Xpanse recommends following the mitigation measures outlined in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a."
},
{
"issueTypeId": "CiscoFirepowerDevice",
"remediationGuidance": "Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\n\nXpanse recommends performing the following steps to keep firewall devices secure:\n\n1. Ensure the firewall’s administration panel is not publicly exposed to the internet.\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts."
},
{
"issueTypeId": "CiscoIOS",
"remediationGuidance": "Cisco IOS is particularly vulnerable to Denial of Service (DOS) attacks due to insufficient resource management vulnerabilities, like https://nvd.nist.gov/vuln/detail/CVE-2022-20697. Cisco IOS is primarily vulnerable when the web administrative interface is publicly exposed, and it is strongly recommended to make the web UI publicly inaccessible as soon as possible.\n\nSince Cisco IOS runs on routers and switches, Xpanse recommends performing the following steps on these devices to remain secure:\n\n1. Ensure the device’s administration panel is not publicly exposed to the internet.\n2. Routinely update the device’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the device behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "CiscoIOSXE",
"remediationGuidance": "Cisco IOS XE is particularly vulnerable to Denial of Service (DOS) attacks due to insufficient resource management vulnerabilities, like https://nvd.nist.gov/vuln/detail/CVE-2022-20697. Cisco IOS XE is primarily vulnerable when the web administrative interface is publicly exposed, and it is strongly recommended to make the web UI publicly inaccessible as soon as possible.\n\nSince Cisco IOS XE runs on routers and switches, Xpanse recommends performing the following steps on these devices to remain secure:\n\n1. Ensure the device’s administration panel is not publicly exposed to the internet.\n2. Routinely update the device’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the device behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "CiscoSecureAccessControlSystem",
"remediationGuidance": "If for any reason it is determined that this device should not be publicly exposed to the internet, identify the asset owner and work to restrict access to the device.\nOrganizations should follow Cisco&#39;s security best practices and ensure instances are up to date and configured securely."
},
{
"issueTypeId": "CiscoSmallBusinessRVSeriesRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "CiscoSmartInstall",
"remediationGuidance": "If an attacker gains access to an exposed Cisco Smart Install service, they can potentially exploit vulnerabilities and perform various malicious actions. These actions include gaining unauthorized access to the switch configuration, which may expose sensitive information like passwords, IP addresses, and network topology. Additionally, they can modify the switch configuration, potentially leading to network disruption or creating backdoors for future access. Attackers can also upload and execute malicious IOS images, compromising the switch and allowing them to gain full control over the device.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Disable Cisco Smart Install if the service is not required by issuing the &#34;no vstack&#34; or &#34;no vstack config&#34; command in global configuration mode on the affected switches, preventing unauthorized access to the service. If the switch or router meets certain conditions however, it may need to be disabled via ACL. More information can be found on a Cisco community post https://community.cisco.com/t5/switching/cisco-smart-install-no-vstack-command/td-p/3363773.\n2. Implement strict network segmentation to isolate devices running Cisco Smart Install from the rest of the network, limiting potential attack surfaces and helping contain any threats that may exploit the service.\n3. Configure Access Control Lists (ACLs) on the switches to restrict incoming traffic to the Cisco Smart Install service, allowing access only from trusted IP addresses or management networks.\n4. Continuously monitor and log activities related to the Cisco Smart Install service, looking for any suspicious behavior or unauthorized access attempts, which helps in early detection and remediation of potential threats.\n5. Keep the Cisco IOS software up to date with the latest patches and security updates, ensuring that known vulnerabilities are addressed and reducing the chances of exploitation by attackers. Regularly review and follow Cisco&#39;s security advisories for any relevant updates.\n\nA helpful document released by the United States of America National Security Agency (NSA) describing how the protocol can be misused (as well as some helpful guidance on remediation) can be found https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF."
},
{
"issueTypeId": "CiscoUnifiedIPPhones",
"remediationGuidance": "IP phones (VoIP telephones, SIP phones or soft phones) are designed for VoIP and use data network instead of the phone network. Organizations should follow security best practices and ensure such devices are configured securely, and only accessible to the public Internet if there is a legitimate business case."
},
{
"issueTypeId": "CiscoWirelessLanController",
"remediationGuidance": "Cisco Wireless LAN Controller has many associated critical vulnerabilities, such as CVE-2022-20695 and CVE-2016-1363, an authentication bypass and buffer overflow vulnerability respectively.\nTo remain protected, ensure that the server is running the latest secure version.\nFor a list of vendor security advisories regarding Wireless LAN Controller, visit https://www.cisco.com/c/en/us/support/wireless/wireless-lan-controller-software/products-security-advisories-list.html."
},
{
"issueTypeId": "CitrixApplicationDeliveryController",
"remediationGuidance": "If an attacker gains access to an exposed Citrix ADC, they can potentially compromise the organization&#39;s security by manipulating traffic, accessing sensitive data, deploying malware, and disrupting application availability.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Implement strict firewall configurations to restrict unauthorized access.\n2. Keep the Citrix ADC updated with the latest security patches.\n3. Enforce multi-factor authentication for administrative access.\n4. Regularly audit and adjust access control policies to maintain security.\n\nMore information on security best practices can be found https://docs.netscaler.com/en-us/citrix-adc-secure-deployment.html#network-security and other helpful information found https://support.citrix.com/article/CTX228148/how-to-lock-down-citrix-adc-management-interfaces-with-acls."
},
{
"issueTypeId": "CitrixGateway",
"remediationGuidance": "If an attacker gains access to an exposed Citrix Gateway, they can potentially compromise the organization&#39;s security by accessing sensitive data, deploying malware, and disrupting operations. This unauthorized access can lead to widespread damage, including data theft, service disruptions, and harm to the organization&#39;s reputation and financial stability.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Ensure proper firewall configurations to restrict unauthorized access.\n2. Apply the latest security patches and updates.\n3. Enforce multi-factor authentication.\n4. Regularly review and adjust access control policies.\n\nMore information on security best practices can be found https://docs.netscaler.com/en-us/citrix-adc-secure-deployment.html#network-security."
},
{
"issueTypeId": "CitrixShareFileServer",
"remediationGuidance": "There are a number of CVEs associated with Citrix ShareFile, such as CVE-2023-24489, a critical improper access control vulnerability. While ShareFile is expected to be accessible on the public internet, there are a number of steps that should be done to ensure the servers remain secure:\n\n1. Upgrade to the latest secure version. For CVE-2023-24489 specifically, upgrade the ShareFile storage zones controllers to version 5.11.24. Details on how to upgrade storage zone controllers can be found in the https://docs.sharefile.com/en-us/storage-zones-controller/5-0/upgrade.html.\n2. If ShareFile is only used internally, consider placing the servers behind a VPN or implement access to approved devices.\n3. Use encrypted protocols at all times when communicating with ShareFile servers.\n4. Monitor for malicious traffic."
},
{
"issueTypeId": "CitrixWorkspace",
"remediationGuidance": "To secure Citrix Workspace instances, it is recommended to perform the following:\n\n1. Isolate Citrix Workspace instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Citrix Workspace instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Citrix Workspace instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Citrix Workspace instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "CitrixXenMobileServer",
"remediationGuidance": "If attackers gain access to a publicly exposed Citrix XenMobile Server instance, an organization’s communication infrastructure could be breached and it could lead to leaks of sensitive proprietary information or could lead to significant communication interruptions.\n\nTo secure Citrix XenMobile Server instances, it is recommended to perform the following:\n\n1. Isolate Citrix XenMobile Server instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Citrix XenMobile Server instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Citrix XenMobile Server instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Citrix XenMobile Server instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ClarioClinicalTrialManagementSystems",
"remediationGuidance": "1. Medical record systems should not be directly accessible from the internet as they pose a significant risk to exposing Protected Health Information (PHI).\n\n2. It is imperative to take a risk based approach considering legal and regulatory issues associated with having a medical record system exposed to the internet.\n\n3. Guidelines and regulatory policy regarding securing Electronic health Records (EHR) can be found https://www.hhs.gov/hipaa/index.html"
},
{
"issueTypeId": "ColocatedAjpServer",
"remediationGuidance": "AJP Servers are not designed to be used over the Internet and should never be exposed publicly.\nCo-located AJP Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the AJP server and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedCiscoSmartInstall",
"remediationGuidance": "If an attacker gains access to an exposed Cisco Smart Install service, they can potentially exploit vulnerabilities and perform various malicious actions. These actions include gaining unauthorized access to the switch configuration, which may expose sensitive information like passwords, IP addresses, and network topology. Additionally, they can modify the switch configuration, potentially leading to network disruption or creating backdoors for future access. Attackers can also upload and execute malicious IOS images, compromising the switch and allowing them to gain full control over the device.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Disable Cisco Smart Install if the service is not required by issuing the &#34;no vstack&#34; or &#34;no vstack config&#34; command in global configuration mode on the affected switches, preventing unauthorized access to the service. If the switch or router meets certain conditions however, it may need to be disabled via ACL. More information can be found on a Cisco community post https://community.cisco.com/t5/switching/cisco-smart-install-no-vstack-command/td-p/3363773.\n2. Implement strict network segmentation to isolate devices running Cisco Smart Install from the rest of the network, limiting potential attack surfaces and helping contain any threats that may exploit the service.\n3. Configure Access Control Lists (ACLs) on the switches to restrict incoming traffic to the Cisco Smart Install service, allowing access only from trusted IP addresses or management networks.\n4. Continuously monitor and log activities related to the Cisco Smart Install service, looking for any suspicious behavior or unauthorized access attempts, which helps in early detection and remediation of potential threats.\n5. Keep the Cisco IOS software up to date with the latest patches and security updates, ensuring that known vulnerabilities are addressed and reducing the chances of exploitation by attackers. Regularly review and follow Cisco&#39;s security advisories for any relevant updates.\n\nA helpful document released by the United States of America National Security Agency (NSA) describing how the protocol can be misused (as well as some helpful guidance on remediation) can be found https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF.\n\nCo-located Cisco Smart Install Service issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Cisco Smart Install service and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedDNP3",
"remediationGuidance": "Co-located DNP3 issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the DNP3 service and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n\nIf an attacker is able to exploit DNP3 they could potentially disrupt or manipulate the operation of a SCADA system. This could lead to various consequences, depending on the industry and application of the system. This can include anything from causing power outages by controlling electrical systems to altering the readings of sensors in water treatment plants to disrupt the treatment process.\n\nIt is recommended to perform the following:\n1. Identify the exposed DNP3 service and assess the extent of the exposure.\n2. Disable or block the exposed service from public access.\n3. Verify that the latest version of DNP3 protocol is being used and update if necessary.\n4. Check for any known vulnerabilities and apply relevant patches or updates.\n5. Review the DNP3 configuration settings and ensure that security best practices are being followed, such as using strong passwords and limiting access to authorized personnel only.\n\nDocumentation regarding the DNP3 protocol can be found at the DNP website https://www.dnp.org/Resources/Public-Documents."
},
{
"issueTypeId": "ColocatedElasticsearchServer",
"remediationGuidance": "1. Elasticsearch servers should never be accessible from the Internet as they are not security hardened and regularly have exploits released for them.\n2. Co-located Elasticsearch server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Elasticsearch servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Elasticsearch server to ensure it is no longer leveraging co-located settings.\n4. Security best practices can be followed from Elastic https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-stack-security.html"
},
{
"issueTypeId": "ColocatedMemcachedServer",
"remediationGuidance": "A co-located Memcached server poses significant risk as Memcached systems may contain sensitive information and should not be externally accessible as they are not hardened against external attacks.\n1. Identify the exposed Memcached server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located Memcached server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Memcached servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Memcached systems to ensure it is no longer leveraging co-located settings.\n4. It is recommended to bind Memcached to a local interface and Disable UDP on the Memcached system (Disabling TCP on the public interface is also recommended but can cause issues with accessing resources outside of the internal network).\n5. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedMicrosoftDnsServer",
"remediationGuidance": "1. Unpatched and misconfigured Microsoft DNS Servers pose a serious security risk to any organization as severe vulnerabilities have been recently released including remote code execution (RCE).\n2. Co-located Microsoft DNS Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Microsoft DNS Servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Microsoft DNS Server to ensure it is no longer leveraging co-located settings.\n4. Microsoft has a free training module around securing Windows Server DNS that can be found https://learn.microsoft.com/en-us/training/modules/secure-windows-server-domain-name-system/"
},
{
"issueTypeId": "ColocatedMongoServer",
"remediationGuidance": "MongoDB servers and database servers in general should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\n\n1. Identify the exposed MongoDB server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located MongoDB server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the MongoDB servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the MongoDB server to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. MongoDB server security best practices can be followed https://www.mongodb.com/docs/manual/administration/security-checklist/."
},
{
"issueTypeId": "ColocatedMoxa",
"remediationGuidance": "Co-located Moxa issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Moxa device and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n\nIf an attacker gains access to a Moxa device, they could potentially compromise the security and integrity of the SCADA system and the connected industrial processes.\n\nIt is recommended to perform the following:\n1. Identify the exposed Moxa device\n2. Secure the device by changing the default password, disabling unnecessary services or features, and updating the firmware\n3. Review the device configuration and implement security best practices\n4. Implement network segmentation to isolate the Moxa device\n5. Monitor the device for any suspicious activity or attempted attacks\n\nAfter identifying the specific Moxa device, it is also recommended to consult the documentation for the product which can be found https://www.moxa.com/en/support/product-support/software-and-documentation."
},
{
"issueTypeId": "ColocatedMssqlServer",
"remediationGuidance": "MSSQL servers (or SQL servers of any kind) should not be publicly accessible over the Internet as they regularly contain sensitive enterprise information and are not hardened to the same security standards as systems designed to be publicly accessible, putting them at risk of compromise.\n\n1. Co-located MSSQL server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory.\n2. Due to the potential for ephemerality and multi-tenancy it is important to identify the MSSQL servers and ensure they are removed.\n3. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedMulticastDnsServer",
"remediationGuidance": "Unpatched and misconfigured Colocated Multicast DNS (mDNS) Servers pose a serious security risk to any organization as mDNS servers are vulnerable to propagating data spills and DDoS related attacks.\n\n1. mDNS servers contain information or are capable of obtaining information about your network infrastructure to include hostnames, IP address, and other device information.\nThis can lead to attackers gaining information about your network architecture and the devices that reside on your network.\n2. mDNS servers can be leveraged for reflective/amplification DoS/DDoS attacks against your organization or other organizations. This is due to the nature of the way DNS/mDNS works. Specifically, mDNS servers are designed to send multicast requests to every host on the network they reside on which can lead to network degradation or outages on your network. Additionally, they can be used to respond to addresses making the request externally, therefore if the IP address were to be spoofed, they would likely reply to that IP instead of the actual requesting IP leading to a use for external DDoS/DoS.\n3. Co-located mDNS server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the mDNS servers and ensure they are configured correctly.\n4:Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the mDNS server to ensure it is no longer leveraging co-located settings.\n5:It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n6. Ensure mDNS servers are not configured to be public facing or available via the internet.\n7. mDNS servers can provide a quick, easy, under the radar method for attackers who have infiltrated your organization to map assets on the network. To provide detection for this ensure verbose logging is available and detections are built on these logs for anomalies such as a 30 day look-back for IP addresses first observed, high query counts, and other potentially nefarious indicators. To provide protection against this implement zero-trust on your mDNS server by allow-list implementation on your mDNS server or devices routing to the mDNS server.\n8. Microsoft mDNS Server best practices can be followed here: https://techcommunity.microsoft.com/t5/networking-blog/mdns-in-the-enterprise/ba-p/3275777"
},
{
"issueTypeId": "ColocatedMysqlServer",
"remediationGuidance": "MySQL servers (or SQL servers of any kind) should not be publicly accessible over the Internet as they regularly contain sensitive enterprise information and are not hardened to the same security standards as systems designed to be publicly accessible, putting them at risk of compromise.\n\n1. Co-located MySQL server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory.\n2. Due to the potential for ephemerality and multi-tenancy it is important to identify the MySQL servers and ensure they are removed.\n3. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedNetBiosNameServer",
"remediationGuidance": "NetBIOS name servers should never be exposed to the public internet as they leak information about users, hostnames, internal IP addresses, services, and operating systems on a local network, and are also not hardened to the same standard as systems designed to be public facing, putting them at risk for exploitation.\n\nBest practice is to not have NetBIOS be publicly accessible from the internet.\n\nCo-located NetBIOS name server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the NetBIOS name servers and ensure they are configured correctly. It is also recommended to reach out to the applicable cloud service provider for any other recommendations."
},
{
"issueTypeId": "ColocatedOPCUA",
"remediationGuidance": "Co-located OPC UA issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the OPC UA server and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n\nIf an attacker were to gain access to an OPC UA Discovery Server, they could potentially discover all the OPC UA enabled devices and applications in the network. This information could be used to launch targeted attacks against these devices or applications, potentially leading to unauthorized access, data theft, or even physical damage to industrial processes.\n\nIt is recommended to perform the following:\n1. Identify and document all devices and applications that are exposed by the Discovery Server.\n2. Verify that the Discovery Server is properly configured and secured, and that it&#39;s only accessible to authorized personnel.\n3. Patch any known vulnerabilities on the Discovery Server and all exposed devices and applications.\n4. Implement strong access controls, including multi-factor authentication and role-based access control, to restrict access to the Discovery Server and all exposed devices and applications.\n5. Monitor the Discovery Server and all exposed devices and applications for any suspicious activity, using intrusion detection systems and security information and event management (SIEM) tools.\n\nDocumentation on OPC UA can be found on the OPC Foundation&#39;s site https://reference.opcfoundation.org/"
},
{
"issueTypeId": "ColocatedOpenBgpServer",
"remediationGuidance": "BGP servers are naturally exposed to the internet as they allow for routing between networks. BGP servers, if not properly secured, can result in malicious rerouting of internet traffic and eavesdropping.\n\n1. Identify the exposed BGP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located BGP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the BGP servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the BGP server to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. BGP server security best practices from the NSA can be followed https://www.nsa.gov/portals/75/documents/what-we-do/cybersecurity/professional-resources/ctr-guide-to-border-gateway-protocol-best-practices.pdf."
},
{
"issueTypeId": "ColocatedPostgresServer",
"remediationGuidance": "Postgres servers and database servers in general should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\n\n1. Identify the exposed Postgres server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located Postgres server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Postgres servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Postgres server to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. Postgres server security best practices can be followed https://www.postgresql.org/docs/current/runtime.html"
},
{
"issueTypeId": "ColocatedPptpServer",
"remediationGuidance": "Point-to-Point Tunneling Protocol (PPTP) is a VPN protocol that is widely considered obsolete and extremely insecure.\nPPTP servers should be replaced with a modern VPN server immediately.\n\n1. Co-located PPTP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory.\n2. Due to the potential for ephemerality and multi-tenancy it is important to identify the PPTP servers and ensure they are removed.\n3. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedRdpServer",
"remediationGuidance": "Recommendations to reduce the likelihood of malicious RDP attempts are as follows:\n\n1. Best practice is to not have RDP publicly accessible on the internet.\n2. Implement a risk-based approach that prioritizes patching RDP vulnerabilities that have known weaponized public exploits.\n3. Limit RDP access to a specific user group.\n4. Implement lockout policies to protect against RDP brute-forcing.\n5. Enable NLA (Network Level Authentication) which is non-default on older versions.\n6. If remote access to RDP or terminal services is a business requirement, it should only be made accessible through a secure Virtual Private Network (VPN) connection with multi-factor authentication (MFA) to the corporate network or through a zero-trust remote access gateway.\n\nFor co-located issues, follow best practice security recommendations from the applicable cloud service provider."
},
{
"issueTypeId": "ColocatedRedisServer",
"remediationGuidance": "Redis servers should never be publicly accessible over the internet as they contain no authentication mechanism and all data is stored in clear text.\n\n1. Identify the exposed Redis server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located Redis server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Redis servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Redis server to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. Redis server security best practices can be followed https://redis.io/docs/manual/security/."
},
{
"issueTypeId": "ColocatedRpcBindServer",
"remediationGuidance": "Rpcbind servers can leak unnecessary information about the corporate environment. Due to this, it is recommended that they should not be exposed to the internet.\nCo-located rpcbind server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the rpcbind server and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedRsyncServer",
"remediationGuidance": "Co-located Rsync servers should not be exposed to the internet as they may contain sensitive information especially since data exposure has become a prominent business risk to organizations.\n\n1. Identify the exposed Rsync server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located Rsync server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Rsync servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Rsync server to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. Rsync should be configured with hosts allow and hosts deny directives in order to follow least privilege principles.\n6. Rysnc should then be setup to use the auth users directive which narrows the attack surface by user.\n7. SSH should be leveraged for all Rysnc communication to allow for encryption."
},
{
"issueTypeId": "ColocatedRtspServer",
"remediationGuidance": "Real Time Streaming Protocol (RTSP)(RFC2326) is an outdated and insecure protocol with multiple publicly available exploits. RTSP generally resides in embedded systems that are not intended to be exposed to the public internet.\n\n1. Identify the exposed RTSP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located RTSP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the RTSP servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the RTSP server to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. Check with the manufacture for security guidance and updates for any device containing the RTSP protocol."
},
{
"issueTypeId": "ColocatedS7CommServer",
"remediationGuidance": "Co-located S7 Comm Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the S7 Comm server and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n\nThe standard S7 communication protocol does not use secure communication methods and can be susceptible to session hijacking, denial of service (DoS) attacks, spoofing, and other attacks.\n\nA best practice is to make these types of devices accessible to trusted networks only. It is recommended that users protect network access with appropriate mechanisms such as firewalls, segmentation, VPN, etc. In addition to that, organizations should password-protect S7 comms and disallow client connections.\n\nPlease follow vendor guidance to configure the operational environment as described in https://www.siemens.com/cert/operational-guidelines-industrial-security."
},
{
"issueTypeId": "ColocatedSipServer",
"remediationGuidance": "1. Co-located Session Initiation Protocol (SIP) issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the SIP devices and ensure they are configured correctly.\n2. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the SIP device to ensure it is no longer configured with co-located settings.\n3. Maintain SIP systems behind a firewall or through a VPN.\n4. If your organization&#39;s SIP server needs to be exposed to the internet, then using high-entropy passwords, lockout policy, and traffic inspection is recommended.\n5. Ensure that usernames are not based on extensions since most brute force attacks will attempt an extension match."
},
{
"issueTypeId": "ColocatedSLP",
"remediationGuidance": "A co-located server utilizing SLP poses a significant risk as exposing SLP publicly would likely allow for an attacker to obtain information about services running on that particular server allowing for them to craft more effective direct attacks. Additionally, it is worth mentioning that this service is sometimes bundled into software as a part of tool’s service discovery functionality which can have detrimental security impacts should the service be available beyond your LAN. An example of this would be the ransomware attacks against VMware ESXi in February of 2023. \n\n1. Contact the co-located server’s administration team and ask that they remove the SLP service on the server from public access as having this service active poses a risk to your service on that system. \n2. If your team administers the server, close port 427 and do not allow traffic to egress from that host. Review logs to determine if any suspicious activity can be identified from traffic outbound on this port in your network (e.g., suspicious external IPs connecting to SLP, large amounts of egress traffic, anomalous packet data, etc.)"
},
{
"issueTypeId": "ColocatedSmbServer",
"remediationGuidance": "Co-located Server Message Block (SMB) servers should never be exposed to the internet as they are frequently targeted in cyber-attacks.\n\n1. Identify the exposed Server Message Block (SMB) server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located SMB server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the SMB servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the SMB server to ensure it is no longer leveraging co-located settings.\n4. Secure the network perimeter by blocking connections to all versions of SMB for TCP ports 445 and 139 and UDP ports 137 and 138.\n5. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n6. SMB server security best practices can be followed https://www.cisa.gov/uscert/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices."
},
{
"issueTypeId": "ColocatedSnmpServer",
"remediationGuidance": "Co-located Simple Network Management Protocol (SNMP) servers should never be exposed to the internet as they are a frequent target of cyber-attacks.\n\n1. SNMPv1 and SNMPv2 are inherently vulnerable due to not supporting any encryption options. It is strongly recommended always to use SNMPv3 whenever possible.\n2. Co-located SNMP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy, it is essential to identify the SNMP servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the SNMP server to ensure it is no longer leveraging co-located settings.\n4. Secure the network perimeter by blocking connections to all versions of SNMP for UDP ports 161 and 162.\n5. It is also recommended to reach out to the applicable cloud service provider for further mitigation recommendations.\n\nFor more detailed guidelines, please review https://www.cisa.gov/uscert/ncas/alerts/TA17-156A."
},
{
"issueTypeId": "ColocatedTelnetServer",
"remediationGuidance": "A co-located Telnet server poses significant risk as Telnet should never be exposed to the internet and, where possible, should be replaced with Secure Shell (SSH)\n\n1. Identify the exposed Telnet server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located Telnet server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Telnet servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Telnet systems to ensure it is no longer leveraging co-located settings.\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\n5. Where possible, replace existing Telnet usage with SSH. If this is not feasible follow recommended guidelines set forth by the manufacturer to mitigate Telnet exposure."
},
{
"issueTypeId": "ColocatedTftpServer",
"remediationGuidance": "In most cases, TFTP should not be used because it provides no built in security or authentication mechanisms. Therefore, the recommended course of action is to immediately remove TFTP from public access. Consider implementing a more secure file transfer protocol, such as FTPS or SFTP.\n\nhttps://datatracker.ietf.org/doc/html/rfc7440#section-7 details security risks associated with TFTP and possible workarounds.\n\nCo-located TFTP Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the TFTP server and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedUnencryptedFtpServer",
"remediationGuidance": "Unencrypted File Transfer Protocol (FTP) servers should never be accessible from the internet as they are not security hardened and regularly have exploits released for them.\nCo-located FTP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the FTP servers and ensure they are configured correctly.\n1. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the FTP server to ensure it is no longer leveraging co-located settings.\n2. Evaluate if there is any PII or sensitive information on the server to understand the impact of the FTP Server transmitting unencrypted information.\n3. Xpanse recommends reconfiguring the server to only accept encrypted FTPS connections or decommissioning the FTP Server and switching to a more modern secured and encrypted file transfer technology."
},
{
"issueTypeId": "ColocatedUpnpServer",
"remediationGuidance": "The Universal Plug and Play (UPnP) protocol allows devices to export services and should not be directly accessible from the internet. There are multiple known vulnerabilities with public exploits available for UPnP libraries.\n\n1. Identify the exposed UPnP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Co-located UPnP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the UPnP servers and ensure they are configured correctly.\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the UPnP server to ensure it is no longer leveraging co-located settings.\n4. Secure the network perimeter by blocking connections to all versions of UPnP for UDP port 1900.\n5. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedVncServer",
"remediationGuidance": "VNC servers should not be directly exposed to the internet as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. The following should be evaluated and performed:\n\n1. Disable or remove the service from the internet.\n2. Review whether VNC is absolutely necessary and see if tunneling VNC over SSH or a VPN can be utilized instead.\n3. Use VNC implementations that encrypt the entire VNC session, including password authentication and data transfer.\n\nFor colocated issues, follow best practice security recommendations from the applicable cloud service provider."
},
{
"issueTypeId": "ColocatedWinRM",
"remediationGuidance": "If an attacker gains access to an exposed WinRM service, they can potentially execute arbitrary commands on the target system, access sensitive information, manipulate system configurations, and move laterally within the network. This can lead to unauthorized access, data breaches, and loss of control over the affected machines, severely compromising the security of the environment.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Disabling WinRM when not required is a crucial step in preventing unauthorized access.\n2. Configuring firewall rules to limit inbound access to the WinRM service only from trusted IP addresses or subnets can help reduce the attack surface.\n3. Implementing strong authentication methods, such as Kerberos or certificate-based authentication, ensures only authorized users can access WinRM. It is important to avoid using Basic or NTLM authentication, as they are less secure.\n4. Enabling encryption for data transmitted between the client and server by enforcing HTTPS instead of HTTP for WinRM communication is essential. This can be achieved by configuring the WinRM listener to use an SSL certificate.\n5. Regularly auditing and monitoring WinRM logs and settings to detect unauthorized access attempts, configuration changes, or other suspicious activities is necessary. It is also important to implement monitoring tools to proactively identify and respond to security threats.\n\nCo-located WinRM Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the WinRM server and ensure it is configured correctly.\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations."
},
{
"issueTypeId": "ColocatedXmppServer",
"remediationGuidance": "XMPP servers should not be accessible on the public internet. If an attacker gains access to an XMPP server, they could view the company structure, perform service discovery, and read messages with confidential information. If an XMPP server must be accessible on the public internet, ensure that:\n1. The server is running with a server certificate.\n2. The server is configured to not allow any cleartext client-to-server or server-to-server communications.\n3. The server supports XEP-0198 and XEP-0124 protocol extensions.\n4. Action is taken to prevent denial of service attacks, such as limiting the amount of connections from a single client.\n\nFor co-located issues, follow best practice security recommendations from the applicable cloud service provider."
},
{
"issueTypeId": "CouchDBServer",
"remediationGuidance": "It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\n\nXpanse recommends securing your database software by taking the following steps:\n\n1. Isolate the database from the public internet by placing it behind a VPN.\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "CrestronAirMedia",
"remediationGuidance": "The Crestron AirMedia line of products has associated CVEs, such as CVE-2019-3929, a critical command injection vulnerability. To secure this device, consider the following:\n\n1. Evaluate whether this Crestron AirMedia device must be accessible on the public internet. If this device is exclusively used inside your organization, consider placing the device inside an internal network.\n2. Upgrade to the latest secure version.\n3. Monitor for vendor https://www.crestron.com/Security/Security-Advisories-All."
},
{
"issueTypeId": "DahuaCameras",
"remediationGuidance": "If an attacker compromises an exposed Dahua security camera, they can gain unauthorized access to live feeds, manipulate camera settings, record and store footage, use the camera as a pivot point for further network attacks, and potentially compromise the privacy and security of individuals and assets being monitored.\n\nIt is recommended to perform the following in order to remain secure:\n1. Change the default username and password to prevent unauthorized access using publicly available credentials. \n2. Update the camera&#39;s firmware regularly to fix known vulnerabilities and enhance security. \n3. Configure network security settings (such as VLANs, firewalls, and encryption) to isolate the camera from the main network and protect it from unauthorized access."
},
{
"issueTypeId": "DataStorageAndAnalysis",
"remediationGuidance": "Data storage devices, such as network attached storage servers, often contain highly confidential data and should not be exposed to the public internet.\n1. It is recommended to identify the asset and work to remove it from being accessible from the internet and instead allow access via a VPN.\n2. If the asset needs to be exposed to the internet for a business purpose, it is recommended to place the device behind a Firewall or Web Application Firewall (WAF) with proper alerting and logging configured."
},
{
"issueTypeId": "DefaultApacheTomcatPage",
"remediationGuidance": "Compromise of a Tomcat landing page could allow an adversary to connect to the management portal, change the configuration, upload new applications, or run arbitrary code on the server. It is recommended to edit &#34;httpd.conf&#34; to display a custom page or removing the file entirely, which will display HTTP 404 error instead of the Tomcat homepage."
},
{
"issueTypeId": "DevelopmentEnvironment",
"remediationGuidance": "With some exceptions, development environments should not be accessible on the public internet. Development environments tend to be less stable and secure than production environments. If a development environment must be publicly accessible, follow these best practices:\n\n1. Utilize MFA on development and user test accounts.\n2. Ensure external libraries and frameworks are up-to-date with the latest security patches.\n3. Log and monitor traffic coming to and from the development environment.\n4. Carefully track access to secret keys and credentials."
},
{
"issueTypeId": "DjangoAdminPage",
"remediationGuidance": "When left unpatched or misconfigured, applications written in Django pose a serious security risk due to the 90&#43; public CVEs associated with this framework.\n\n1. Ensure your organization is running the latest version of Django to prevent known/active exploits from being successfully ran against your web applications.\n2. Never place admin logins for applications on a public facing asset or, if necessary, do not make the accessible from the internet.\n3. Ensure best practices are being followed for input sanitation to prevent successful injection attacks.\n4. Enable robust application and server logging to monitor for nefarious activities such as XSS, fuzzing, port/host discovery scanning, vulnerability scanning, SQL injection, file inclusion attacks, brute force activities, and cross-site request forgery.\n5. Place your web applications behind network security devices on your edge (such as WAFs) and enable monitoring on these devices along with DDoS mitigation functions."
},
{
"issueTypeId": "DLinkDCS930L",
"remediationGuidance": "D-Link DCS-930L cameras are vulnerable to remote code execution and CSRF attacks (particularly notable: https://nvd.nist.gov/vuln/detail/CVE-2016-11021, https://nvd.nist.gov/vuln/detail/CVE-2019-10999, https://nvd.nist.gov/vuln/detail/CVE-2017-7852 and depending on network topology, they can serve as an entry point into your organization’s network.\n\nXpanse recommends securing DCS-930L surveillance systems by taking the following steps:\n\n1. Ensure DCS-930L is on a separate network from your main network. This separation will prevent attackers who manage to break into the surveillance system from traversing into the main network, where more damage can be caused. The reverse can also happen, where attackers who manage to breach the main network can gain access to physical systems.\n2. Do not publicly expose the DCS-930L surveillance server. If there is a strong business case for public exposure, then it is strongly recommended to place this server behind a https://www.paloaltonetworks.com/network-security/next-generation-firewall.\n3. Make sure the camera OS is always up-to-date with the latest patches.\n4. Enforce complex passwords and do not allow reusable passwords (which is a common attack vector)\n5. Ensure all connections to the camera are SSL-encrypted."
},
{
"issueTypeId": "DLinkDCSSeriesDevice",
"remediationGuidance": "D-Link DCS Series cameras are vulnerable to remote code execution and CSRF attacks (particularly notable: https://nvd.nist.gov/vuln/detail/CVE-2016-11021, https://nvd.nist.gov/vuln/detail/CVE-2019-10999, https://nvd.nist.gov/vuln/detail/CVE-2017-7852 and depending on network topology, they can serve as an entry point into your organization’s network.\n\nXpanse recommends securing D-Link DCS Series surveillance systems by taking the following steps:\n\n1. Ensure the DCS device is on a separate network from your main network. This separation will prevent attackers who manage to break into the surveillance system from traversing into the main network, where more damage can be caused. The reverse can also happen, where attackers who manage to breach the main network can gain access to physical systems.\n2. Do not publicly expose DCS devices. If there is a strong business case for public exposure, then it is strongly recommended to place this server behind a https://www.paloaltonetworks.com/network-security/next-generation-firewall.\n3. Make sure the camera OS is always up-to-date with the latest patches.\n4. Enforce complex passwords and do not allow reusable passwords (which is a common attack vector)\n5. Ensure all connections to the camera are SSL-encrypted"
},
{
"issueTypeId": "DLinkDir300SeriesDevice",
"remediationGuidance": "Since this product is now considered End of Life (EoL), it is recommended to remove this device from being publicly accessible and look into a more up-to-date alternative.\n\nIf this device cannot be replaced, it is recommended to perform the following in order to remain secure:\n1. Update the router&#39;s firmware by downloading and installing the latest version from the D-Link support website.\n2. Replace the default username and password with strong, unique credentials.\n3. Turn off remote management features to prevent unauthorized external network access.\n4. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n5. Place the router behind appropriate security tooling such as a firewall."
},
{
"issueTypeId": "DLinkDir610Device",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "DLinkDir800SeriesDevice",
"remediationGuidance": "If you have a D-Link DIR-800 Series router that has been exposed and is vulnerable, there are several steps you can take to remediate the issue:\n\n1. Disconnect the device from the network to prevent any potential further access or compromises. \n2. Check the D-Link website for the latest firmware for your router and install it. The updated firmware should include patches for any known vulnerabilities.\n3. Make sure to change the username and password for the router&#39;s administrative console. Choose a strong password that is not easily guessable.\n4. If enabled, disable remote management of the router to prevent unauthorized access. This option is usually found in the router&#39;s administrative console.\n5. Make sure that your wireless network is secured with WPA2 encryption. This will help prevent unauthorized access to your network.\n6. Universal Plug and Play (UPnP) is a feature that can allow devices on your network to automatically open ports in your router&#39;s firewall, this should be disabled. This can create a security vulnerability, so it&#39;s a good idea to disable UPnP if you&#39;re not using it.\n7. Use the router&#39;s administrative console to check for any unauthorized devices connected to your network."
},
{
"issueTypeId": "DNP3",
"remediationGuidance": "If an attacker is able to exploit DNP3 they could potentially disrupt or manipulate the operation of a SCADA system. This could lead to various consequences, depending on the industry and application of the system. This can include anything from causing power outages by controlling electrical systems to altering the readings of sensors in water treatment plants to disrupt the treatment process.\n\nIt is recommended to perform the following:\n1. Identify the exposed DNP3 service and assess the extent of the exposure.\n2. Disable or block the exposed service from public access.\n3. Verify that the latest version of DNP3 protocol is being used and update if necessary.\n4. Check for any known vulnerabilities and apply relevant patches or updates.\n5. Review the DNP3 configuration settings and ensure that security best practices are being followed, such as using strong passwords and limiting access to authorized personnel only.\n\nDocumentation regarding the DNP3 protocol can be found at the DNP website https://www.dnp.org/Resources/Public-Documents."
},
{
"issueTypeId": "DockerRegistry",
"remediationGuidance": "A compromised Docker Registry server may provide an attacker with access to an organization&#39;s Docker images.\nIt is recommended to evaluate whether this service should be exposed to the internet or not.\nIf the service needs to be exposed to the internet for a business purpose, it is recommended to put the device behind security tooling such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled."
},
{
"issueTypeId": "DomainControlValidatedCertificate",
"remediationGuidance": "While most browsers will accept domain control validated certificates, they are generally seen as a less-secure certificate due to lax identity verification. Domain control validated certificates are often used by cyber criminals to impersonate websites. Reputable websites should use trusted Certificate Authorities (CA) and opt for high-assurance validation methods, such as Extended Validation."
},
{
"issueTypeId": "dotCMS",
"remediationGuidance": "If an attacker gains access to an exposed dotCMS server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization&#39;s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the dotCMS server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\n2. Regularly update the dotCMS software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\n5. Monitor the dotCMS server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices.\n\nMore information on secure configurations and best practices can be found https://www.dotcms.com/docs/latest/security-best-practices."
},
{
"issueTypeId": "DotNetNukeCMS",
"remediationGuidance": "If an attacker gains access to an exposed DotNetNuke CMS server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization’s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the DotNetNuke CMS server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\n2. Regularly update the DotNetNuke CMS software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\n5. Monitor the DotNetNuke CMS server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices."
},
{
"issueTypeId": "DrayTekVigorRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "ElasticKibanaUserInterface",
"remediationGuidance": "To secure Elastic Kibana interfaces, it is recommended to perform the following:\n\n1. Isolate Elastic Kibana interfaces from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Elastic Kibana interfaces should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Elastic Kibana interfaces are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Elastic Kibana interfaces. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ElasticsearchServer",
"remediationGuidance": "It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\n\nXpanse recommends securing your database software by taking the following steps:\n\n1. Isolate the database from the public internet by placing it behind a VPN.\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "EmbeddedSystem",
"remediationGuidance": "Embedded systems are frequently misconfigured and a common target of bad actors. Often embedded systems are not adequately secured, and depending on network topology, they can serve as an entry point into your organization’s network.\n\nXpanse recommends securing embedded systems through these best practices:\n\n1. Ensure the system is separate from your main network. This separation will prevent attackers who manage to break into your embedded systems from traversing into the main network, where more damage can be caused. The reverse can also happen, where attackers who manage to breach the main network can gain access to physical systems.\n2. Do not publicly expose embedded system servers. If there is a strong business case for public exposure, it is strongly recommended to place this server behind a firewall and restrict TCP/IP ports to critical ones.\n3. Make sure the OS is always up-to-date with the latest patches.\n4. Enforce robust authentication and do not allow weak or reusable passwords.\n5. Do not use inherently insecure protocols like Telnet.\n6. Ensure the system is secured at boot time by using cryptographically-signed boot images. The same approach applies to securing the system at execution time, which confirms that all running services are signed and prevent malware from running on the system.\n\nFor more detailed guidelines, please review https://www.cisa.gov/uscert/sites/default/files/ICSJWG-Archive/QNL_SEP_20/Protecting%20Embedded%20Systems%20-%20Verve%20Industrial_S508NC.pdf."
},
{
"issueTypeId": "EximMailTransferAgent",
"remediationGuidance": "To secure Exim Mail Transfer Agent instances, it is recommended to perform the following:\n\n1. Isolate Exim Mail Transfer Agent instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Exim Mail Transfer Agent instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Exim Mail Transfer Agent instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Exim Mail Transfer Agent instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ExpiredWhenScannedCertificate",
"remediationGuidance": "Expired certificates on active services are a good indication that a system may not be under active management. This can result in a lack of trust from external parties due to the web browser&#39;s warning for expired certificate.\n1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \n2. Identify all existing certificates and their expiration dates. For certificates that have expired follow established procedure to revoke and replace the certificate.\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions. https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html"
},
{
"issueTypeId": "ExpiringCertificate",
"remediationGuidance": "Expired certificates and certificates about to expire on active services are a good indication that a system may not be under active management. This can result in a lack of trust from external parties due to the web browser&#39;s warning for expired certificate.\n\n1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \n2. Identify all existing certificates and their expiration dates. For certificates that have expired or are about to expire follow established procedure to revoke and replace the certificate.\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html."
},
{
"issueTypeId": "ExpiringDomain",
"remediationGuidance": "Due to the fact that expired domains lead to significant security risks, certificates should be renewed prior to their expiry date."
},
{
"issueTypeId": "ExposedDirectoryListing",
"remediationGuidance": "Directory listing is a web server feature that displays an index of all the resources in a website’s directory. Malicious actors can use the critical information gained from exposed directory listings to discover vulnerabilities that could be exploited in your organization’s environment. It is recommended to take the following steps to secure your environment:\n\n1. Disable directory listings in your web server’s configuration for all paths. You can also place an empty *index.html* file in the web server root, which will instead display an empty page. This approach doesn’t provide a strong level of protection and is only recommended as a temporary solution until the web server configuration can be updated.\n2. Verify that directory metadata is hidden.\n3. Review your application’s access control policy and confirm that it conforms to current security best practices.\n\nFurther documentation: https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
},
{
"issueTypeId": "F5AdvancedWebApplicationFirewall",
"remediationGuidance": "Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\n\nXpanse recommends performing the following steps to keep firewall devices secure:\n\n1. Ensure the firewall’s administration panel is not publicly exposed to the internet.\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts."
},
{
"issueTypeId": "F5BigIpAccessPolicyManager",
"remediationGuidance": "F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\n\nXpanse recommends the following mitigation steps:\n\n1. Secure your BIG-IP systems by not exposing them to the public internet.\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP’s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access."
},
{
"issueTypeId": "F5BigIpPlatform",
"remediationGuidance": "F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\n\nXpanse recommends the following mitigation steps:\n\n1. Secure your BIG-IP systems by not exposing them to the public internet.\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP’s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access."
},
{
"issueTypeId": "F5BigIpTmui",
"remediationGuidance": "F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\n\nXpanse recommends the following mitigation steps:\n\n1. Secure your BIG-IP systems by not exposing them to the public internet.\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP’s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access."
},
{
"issueTypeId": "F5BigIqServer",
"remediationGuidance": "F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\n\nXpanse recommends the following mitigation steps:\n\n1. Secure your BIG-IP systems by not exposing them to the public internet.\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP’s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access."
},
{
"issueTypeId": "FatPipeIPVPN",
"remediationGuidance": "Certain FatPipe IPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to identify the asset owner.\n2. If version number is not identified, determine what version is running on the device to infer vulnerability.\n3. Work to patch the device to the latest secure version if it is found to be vulnerable.\n4. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf."
},
{
"issueTypeId": "FatPipeMPVPN",
"remediationGuidance": "Certain FatPipe MPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to identify the asset owner.\n2. If version number is not identified, determine what version is running on the device to infer vulnerability.\n3. Work to patch the device to the latest secure version if it is found to be vulnerable.\n4. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf."
},
{
"issueTypeId": "FatPipeVPNDevice",
"remediationGuidance": "FatPipe devices currently have high impact CVEs available for them that allow for threat actors to breach organizations and gain access to internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to understand which specific FatPipe device is being used.\n2. Determine what version is running on the device to infer vulnerability.\n3. More information regarding vulnerable versions and impact can be found on the published https://www.ic3.gov/Media/News/2021/211117-2.pdf."
},
{
"issueTypeId": "FatPipeWARP",
"remediationGuidance": "Certain FatPipe WARP devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to identify the asset owner.\n2. If version number is not identified, determine what version is running on the device to infer vulnerability.\n3. Work to patch the device to the latest secure version if it is found to be vulnerable.\n4. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf."
},
{
"issueTypeId": "ForeScoutCounterACT",
"remediationGuidance": "Due to the control and visibility a network access control (NAC) device has for an organization&#39;s network, it is recommended that this device not be accessible from the public internet. It is recommended to identify the asset owner and work with them to disable public internet access to the device."
},
{
"issueTypeId": "ForgerockIdentityManagement",
"remediationGuidance": "If an attacker gains access to a ForgeRock Identity Management server, they can potentially perform unauthorized actions such as stealing sensitive user data, manipulating user accounts, and gaining unauthorized access to other connected systems.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Ensure the ForgeRock Identity Management server is running on the latest version and all security patches are applied. Regularly check for updates and apply them in a timely manner to fix known vulnerabilities.\n2. Implement proper access controls, such as role-based access control (RBAC), to restrict unauthorized access to the server. Limit administrative access to a select group of users, and enforce strong authentication mechanisms like multi-factor authentication (MFA).\n3. Disable or remove all unnecessary services, ports, and modules to minimize the attack surface. Follow the ForgeRock hardening guide to properly configure the server and apply security best practices.\n4. Configure the server to use secure communication protocols like HTTPS (TLS/SSL) to encrypt data in transit. Make sure to use strong encryption algorithms and valid certificates issued by a trusted certificate authority.\n5. Continuously monitor the server for any suspicious activities or access attempts. Implement logging and auditing mechanisms to keep track of all server activities. Regularly review logs and perform security audits to identify and remediate any potential security threats.\n\nThe ForgeRock IDM security guide can be found https://backstage.forgerock.com/docs/idm/7/security-guide/."
},
{
"issueTypeId": "ForgeRockOpenAM",
"remediationGuidance": "If you have identified an exposed instance of ForgeRock OpenAM, it is important to take immediate action to remediate the vulnerability and protect your system from potential attacks. Here are some steps you can take:\n\n1. Quarantine the system to ensure no further potential compromise takes place.\n2. Review all available system and network logs to determine if a compromise took place. If a compromise has taken place take all necessary actions to contain, eradicate, and remediate impacted systems.\n3. Check if there is a new version of ForgeRock OpenAM available, and upgrade to the latest version if possible. This may include updating dependencies and plugins as well.\n4. Review all security controls and ensure that only the necessary ports are open. Restrict access to the ForgeRock OpenAM from only trusted sources.\n5. Ensure that the system hosting the ForgeRock OpenAM is hardened and configured securely. This includes configuring secure passwords, limiting user access, and disabling unnecessary services.\n6.Implement monitoring and alerts to detect any future vulnerabilities or attacks. This may include setting up alerts for unusual activity, configuration changes, or failed login attempts.\n7. Conduct a vulnerability scan of the system to identify any other vulnerabilities that may exist.\n8. Follow security best practices for securing and maintaining your system, such as regularly applying security patches and keeping software up-to-date."
},
{
"issueTypeId": "FortinetDevice",
"remediationGuidance": "Fortinet devices should only be accessible on an organization&#39;s private network. These assets should be monitored closely and access control lists should be used to restrict access. To ensure the device is secure:\n\n* Determine the device that is getting flagged by the issue.\n* Consider if the device should be publicly accessible.\n* Visit the https://www.fortiguard.com/psirt and ensure that you are running the latest secure version of the identified product."
},
{
"issueTypeId": "FortinetFortigateSslVpn",
"remediationGuidance": "VPN devices are often publicly accessible and, as a result, are a frequent target of sophisticated attacks. Fortigate SSL-VPN is vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2023-27997, which could lead to unauthenticated attackers performing remote code execution. To secure your instances of Fortigate SSL-VPN, Xpanse recommends implementing a Zero-Trust architecture and staying up-to-date on the latest patches:\n\n1. Create a security zone for all VPN traffic. Using security zones is a security best practice for VPNs because it creates a tunnel interface and gives organizations visibility into the IP pools used for remote users. This helps with proactively detecting intruders and containing attacks for remote users. Please note that split tunneling is not recommended as it may lead to critical data being intercepted by malicious actors.\n2. Create NAT policies to secure traffic and use user groups and application IDs to reduce your organization’s attack surface.\n3. Closely monitor traffic logs by surveying the egress traffic.\n4. Ensure that disabling Fortigate SSL-VPN is only allowed for a short interval of time (the default timeout is 30 min).\n5. Enable 2FA for all users"
},
{
"issueTypeId": "FortinetFortiNAC",
"remediationGuidance": "Fortinet FortiNAC is vulnerable to CVE-2022-39952, a remote-code execution vulnerability with a proof-of-concept exploit that was publicly exploited. It is critical that:\n\n* All FortiNAC devices are updated to the latest security patch.\n* Ensure that no administrator panels are publicly exposed. An attacker that gains access to FortiNAC internals will be able to compromise a network.\n* The complete list of https://www.fortiguard.com/psirt?product&#61;FortiNAC should be actively monitored. These advisories include version information and latest recommended solutions."
},
{
"issueTypeId": "FortinetFortiOS",
"remediationGuidance": "Fortinet devices should only be accessible on an organization&#39;s private network. These assets should be monitored closely and access control lists should be used to restrict access. To ensure the device is secure:\n\n* Determine the device that is getting flagged by the issue.\n* Consider if the device should be publicly accessible.\n* Visit the https://www.fortiguard.com/psirt and ensure that you are running the latest secure version of the identified product."
},
{
"issueTypeId": "FortraGoAnywhereManagedFileTransfer",
"remediationGuidance": "Fortra GoAnywhere Managed File Transfer (MFT) has been affected by numerous security vulnerabilities. There are a number of steps that should be taken to ensure your organization remains secure.\n\n1. Determine if this asset must be publicly accessible. If there is not clear business need for this file transfer system to be publicly accessible (for example, if it were solely used for internal use) consider removing the service from the public internet.\n2. Upgrade MFT to the latest secure version."
},
{
"issueTypeId": "FoxServer",
"remediationGuidance": "Due to the potential for sensitive information to be passed through Niagara, ensure that Niagara is running the latest security patch and the control server is not exposed to the public Internet."
},
{
"issueTypeId": "FranklinFuelingSystems",
"remediationGuidance": "If an attacker gains access to an exposed Franklin Fueling Systems device, they can potentially manipulate the fuel inventory data, disrupt the leak detection system, and compromise delivery reconciliation. This could lead to financial loss, undetected leaks or spills, environmental damage, and non-compliance with regulatory requirements. Additionally, the attacker could potentially gain access to sensitive information related to fuel deliveries and transactions, leading to data breaches and reputational harm for the affected business.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the device within a separate network segment, restricting access to only authorized users and systems.\n2. Implement proper firewall rules to block unauthorized access and limit inbound and outbound traffic to the device.\n3. Enable strong authentication mechanisms, such as multi-factor authentication (MFA), to prevent unauthorized access.\n4. Ensure that the device firmware is up-to-date and apply security patches regularly to fix any known vulnerabilities.\n5. Use encrypted communication channels, such as VPNs or secure protocols like HTTPS, to protect data transmission between the device and authorized systems.\n6. Regularly monitor and review logs for any signs of unauthorized access or suspicious activity, and conduct security audits to ensure compliance with best practices and regulations."
},
{
"issueTypeId": "FreeBSD",
"remediationGuidance": "FreeBSD has been widely targeted by nefarious actors leading to the release of a multitude of CVEs with a CVSS of 10.0. An unpatched or misconfigured instance of FreeBSD in your environment poses a serious security risk. The following steps are recommended to keep your environment safe from attacks targeting FreeBSD:\n\n1. Ensure your instance of FreeBSD is patched and up to date with the latest version available. https://www.freebsd.org/releases/\n2. Ensure your instance of FreeBSD is sitting behind security controls such as a WAF, NGFW, and/or VPN infrastructure.\n3. Ensure you have verbose logging on your instance of FreeBSD to effectively monitor for attacks targeting these systems.\n4. Implement strict access controls on any FreeBSD system that may be public facing\n\nReferences:\n* https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
},
{
"issueTypeId": "FujifilmSynapseRIS",
"remediationGuidance": "1. Medical record systems should not be directly accessible from the internet as they pose a significant risk of exposing Protected Health Information (PHI).\n2. It is imperative to take a risk-based approach considering legal and regulatory issues associated with having a medical record system exposed to the internet.\n3. Guidelines and U.S. regulatory policy regarding securing Electronic Health Records (EHR) can be found https://www.hhs.gov/hipaa/index.html"
},
{
"issueTypeId": "GithubCertificate",
"remediationGuidance": "There is no inherent risk with Github related certificates. However, ensure that the Github service is intentionally exposed and no confidential information is exposed. If not, work to identify the asset owner and remove the device from being publicly accessible."
},
{
"issueTypeId": "GitLab",
"remediationGuidance": "Compromise of a GitLab instance could potentially lead to source code in the repos being leaked or stolen.\nIt is recommended to identify the asset owner and verify that GitLab needs to be exposed to the public internet. If not, work with them to remove it.\nIf GitLab needs to be exposed to the internet, it is recommended to follow their documentation on securing the installation which can be found https://docs.gitlab.com/ee/security/\nIt is also recommended to place the instance behind security controls such as a Web Application Firewall (WAF)."
},
{
"issueTypeId": "GlobalscapeEFT",
"remediationGuidance": "If an attacker gains access to an exposed Globalscape EFT instance, they could potentially steal sensitive data being transferred through the system, modify or delete files, and even gain access to other systems connected to the EFT instance.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Ensure that the EFT instance is running the latest version with all necessary patches and updates.\n2. Configure the EFT instance to use secure protocols such as SFTP or HTTPS.\n3. Implement strong password policies and enable two-factor authentication.\n4. Configure firewalls and network access controls to limit access to the EFT instance to only authorized users and systems.\n5. Implement monitoring and logging to detect and alert on any suspicious activity.\n6. Regularly review and analyze logs and alerts to identify potential security issues.\n7. Conduct regular vulnerability scans and penetration testing to identify potential vulnerabilities and security gaps.\n8. Ensure that all employees are trained on secure file transfer practices, including how to detect and report suspicious activity.\n9. Implement security information and event management (SIEM) tools to aggregate and analyze security events across the organization.\n10. Implement encryption for data at rest and in transit to protect sensitive information from unauthorized access.\n\nFor more information regarding best practices for Globalscape EFT, please reference the following documentation found https://kb.globalscape.com/Knowledgebase/11312/Configuration-and-Security-Best-Practices."
},
{
"issueTypeId": "GlpiServiceManagement",
"remediationGuidance": "It is not recommended to make GLPI (Gestionnaire Libre de Parc Informatique) accessible on the public internet as it may pose security risks. GLPI is primarily designed for internal use within an organization, and exposing it to the public internet may increase the chances of unauthorized access, hacking, or other security threats. For example, GLPI is susceptible to CVE-2022-35914, a remote code execution vulnerability.\n\nIf you need to access GLPI from outside your organization&#39;s network, it is recommended to use a VPN (Virtual Private Network) or other secure remote access solutions. This way, you can ensure that the application is only accessible to authorized users and that all communications are encrypted and secure."
},
{
"issueTypeId": "GoogleCloud",
"remediationGuidance": "If you have identified an exposed vulnerable instance on Google Cloud, you should take immediate steps to remediate the situation to prevent any potential security breaches or data loss. Here are some steps you can follow to remediate an exposed vulnerable instance:\n\n1. Once you have identified the vulnerable instance, isolate it from the rest of your network to prevent further exposure and potential attacks.\n2. Check for available patches or updates for the software or application running on the instance. Apply the relevant patches or updates as soon as possible.\n3. If the instance was using default credentials, change them immediately to prevent any unauthorized access.\n4. Review your security policies and ensure that they are up-to-date and effective. Check for any misconfigurations or security gaps that may have contributed to the exposure.\n5. Monitor the instance for any suspicious activity or unusual traffic patterns. Set up alerts and notifications to ensure that you are notified immediately of any potential security threats.\n6. Perform regular vulnerability scans to identify any new vulnerabilities and potential security risks."
},
{
"issueTypeId": "GoogleWebFrameworkAngular",
"remediationGuidance": "Angular when unpatched and misconfigured poses a serious security risk to any organization as severe vulnerabilities have been recently released including remote code execution (RCE).\n\n1. Given the nature of CVE-2021-4231, Xpanse recommends enforcing strict input sanitation measures on webpages built on Angular to prevent similar exploits.\n\n2. Ensure monitoring is configured to detect attacks such as cross-site scripting, cross-site request forgery, SQL injection, and other nefarious activities."
},
{
"issueTypeId": "Grafana",
"remediationGuidance": "Grafana is vulnerable to a number of critical vulnerabilities, such as CVE-2022-31107 and CVE-2022-26148, which can lead to authentication bypass and exposed passwords.\n1. Update Grafana to the latest secure version.\n2. Validate that the information displayed in Grafana should be publicly accessible. If not, work with the asset owner to remove the Grafana instance from the public internet.\n3. For in-depth vendor recommendations, visit https://grafana.com/go/webinar/grafana-security-features/."
},
{
"issueTypeId": "GrandstreamNetworksUCM6200SeriesDevice",
"remediationGuidance": "Evaluate whether or not this device should be exposed to the public internet.\nIf it is determined that this device should not be exposed to the public internet, identify the asset owner and work with them to remove the device from being publicly accessible."
},
{
"issueTypeId": "H3CFirewall",
"remediationGuidance": "If an attacker gains access to an exposed H3C Firewall, they can potentially modify security rules allowing unauthorized access and malicious traffic into the protected network.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Update the firmware to the latest version.\n2. Replace default credentials with strong, unique ones.\n3. Restrict remote management access.\n4. Configure access control lists.\n5. Monitor logs for suspicious activity.\n6. Periodically review and adjust firewall settings to maintain a secure network environment."
},
{
"issueTypeId": "H3CRouter",
"remediationGuidance": "If an attacker gains access to an exposed H3C Router, they can intercept and manipulate network traffic, compromising sensitive data and connected devices. Additionally, they may modify router configurations, create network vulnerabilities, launch DDoS attacks, or use the compromised router as a pivot point for further attacks within the organization&#39;s network.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Ensure the H3C router is running the latest firmware version to fix known vulnerabilities and enhance security features.\n2. Replace default usernames and passwords with strong, unique credentials to prevent unauthorized access.\n3. Disable remote management features, such as Telnet and SSH, if not required, to reduce the attack surface.\n4. Configure access control lists to restrict incoming and outgoing traffic to specific IP addresses and ports, limiting potential threats.\n5. Use HTTPS for secure web-based management and disable HTTP access.\n6. Turn off unused services and protocols, such as UPnP, SNMP, and FTP, to minimize potential attack vectors.\n7. Set up router logs and monitor them regularly for any suspicious activity or security incidents.\n8. Separate the router&#39;s internal network from external networks using VLANs or subnets to limit the scope of potential attacks.\n9. Activate the router&#39;s built-in firewall to filter and block malicious traffic.\n10. Periodically review the router&#39;s settings and make necessary changes to maintain a secure environment."
},
{
"issueTypeId": "HadoopServer",
"remediationGuidance": "Apache Hadoop servers should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\n\n1. Identify the exposed Apache Hadoop server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Ensure that Apache Hadoop is configured in secure mode allowing for data encryption and Role Based Access Controls (RBAC).\n3. Apache Hadoop server security best practices can be followed https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-common/SecureMode.html."
},
{
"issueTypeId": "HclBigFixPlatform",
"remediationGuidance": "Compromise of an asset belonging to the BigFix Platform can lead to data loss or further compromise of other assets due to the broad reach that the BigFix platform can have in an organization. It is recommended to have the root server in the BigFix Platform behind security tooling with appropriate logging enabled.\nFor more information about secure configurations and architecture, reference the BigFix Platform Wiki documents found https://bigfix-wiki.hcltechsw.com/wikis/home?lang&#61;en-us#!/wiki/BigFix%20Wiki/page/Security%20Overview."
},
{
"issueTypeId": "HikvisionDevice",
"remediationGuidance": "If attackers gain access to a publicly exposed Hikvision device, they can extract or infer sensitive information about physical infrastructure or internal operations.\n\nTo secure Hikvision devices, it is recommended to perform the following:\n\n1. Isolate Hikvision devices from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Hikvision devices should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Hikvision devices are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Hikvision devices. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "HoneywellAccessSystems",
"remediationGuidance": "If you have identified that your Honeywell Access System has been exposed, the following steps should be taken:\n\n1. Disconnect the Honeywell Access System from the network to prevent any further access to the exposed system.\n2. Assess the potential risks associated with the exposure, including the impact on the system, data, or any other connected systems.\n3. Ensure you have proper security controls in place such as firewalls, intrusion detection systems, and antivirus software to prevent unauthorized access.\n4. Change all default and existing passwords, and use strong passwords that are difficult to guess.\n5. Ensure that the Honeywell Access System is running the latest firmware and software, which often includes security patches and updates.\n6. Regularly monitor the system for any suspicious activity or unauthorized access.\n7. Review logs to determine if any nefarious activity has taken place prior to the discovery of the exposed device."
},
{
"issueTypeId": "HoneywellNetAXS",
"remediationGuidance": "NetAXS is often used to manage access to critical infrastructure sites and should not be publicly exposed on the internet. Should an attacker gain access to NetAXS, they may gain complete control of all access entry points of a physical site that are reachable remotely. This type of attack may translate into attackers being able to lock/unlock doors, revoke access for key personnel, or laterally traverse the network and infiltrate other systems integrated with NetAXS.\n\nXpanse recommends securing NetAXS by taking the following steps:\n\n1. Ensure that no access entry points are using default installer codes. This is a typical and low-complexity attack vector where attackers can quickly discover or guess the default installer code for the product and gain access to the system.\n2. Place NetAXS behind a firewall and implement a DMZ network architecture to isolate NetAXS from other critical systems.\n3. Expeditiously update NetAXS to use the latest patches.\n4. Implement strict access control policies that follow the principle of least privilege. This means that all users should have access only to the essential components that allow them to do their jobs.\n5. Regularly monitor network activity and user engagement and set up robust alerting."
},
{
"issueTypeId": "HoneywellNiagaraBCS",
"remediationGuidance": "If an attacker successfully compromises an exposed Honeywell Niagara Building Control System, they could potentially gain complete control over the targeted building automation system (BAS). This could allow them to access sensitive data, such as HVAC and lighting system configurations, and even manipulate them to cause physical damage or disrupt building operations.\n\nIt is recommended to perform the following:\n1. Disconnect the server from the network to isolate it for investigation.\n2. Investigate the extent of the compromise and identify any potential areas of vulnerability or compromise (if any).\n3. Ensure that the server is running the latest version of the Honeywell Niagara Building Control System software and that all patches and updates have been applied to address any known vulnerabilities.\n4. Reset all passwords associated with the server and any connected systems to strong, unique passwords that are difficult to guess or crack.\n5. Consider implementing additional security measures, such as firewalls, intrusion detection systems, access controls, and network segmentation, to prevent future attacks and improve overall security posture."
},
{
"issueTypeId": "HoneywellXLWebController",
"remediationGuidance": "If you have identified a Honeywell XL Web Controller in your network that has been exposed, the following steps can be taken to remediate the exposure of the device:\n\n1. Disconnect the Honeywell XL Web Controller from the network to prevent any further access to the exposed system.\n2. Assess the potential risks associated with the exposure, including the impact on the system, data, or any other connected systems.\n3. Implement proper security control measures such as firewalls, intrusion detection systems, and antivirus software to prevent unauthorized access.\n4. Change all default and existing passwords, and use strong passwords that are difficult to guess.\n5. Ensure that the Honeywell XL Web Controller is running the latest firmware and software, which often includes security patches and updates.\n6. Elevate monitoring for the system to identify any suspicious activity or unauthorized access.\n7. Review logs to determine if any compromise took place prior to the discovery of the exposed device."
},
{
"issueTypeId": "HttpStatusCode404",
"remediationGuidance": "While there is no inherent security risk for an HTTP server to return a 404 status code, there are a number of steps that can be done to ensure applications that should be accessible remain accessible:\n1. Identify the cause of the 404 error: Review the server logs to determine the cause of the error. It could be due to a broken link, a deleted page, or a mistyped URL.\n2. If the page has been deleted or moved, you can redirect the user to a relevant page using a 301 redirect."
},
{
"issueTypeId": "IBMAsperaFaspex",
"remediationGuidance": "Public facing instances of IBM Aspera Faspex are at far greater risk for exploitation due to multiple vulnerabilities and common attack methodologies. Additionally, hosting this service on your public facing infrastructure increases your attack surface and should be avoided if possible. It is recommended to restrict access to your IBM Aspera Faspex application by taking the following steps:\n\n1. If your organization’s IBM Aspera Faspex service must be public facing due to your network architecture, place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\n2. Block all unexpected outbound network traffic to prevent potentially propagating confidential/sensitive data spills due to malware/exploits running on/against the system.\n3. Ensure you have the latest version of IBM Aspera Faspex deployed as all prior versions of the application to date have been noted as vulnerable to multiple different attack methodologies."
},
{
"issueTypeId": "IBMCognosAnalytics",
"remediationGuidance": "Public facing instances of IBM Cognos Analytics are at far greater risk for exploitation due to multiple vulnerabilities and common attack methodologies. Additionally, hosting this service on your public facing infrastructure increases you attack surface and should be avoided if possible. Xpanse recommends restricting access to your IBM Cognos Analytics application by taking the following steps:\n\n1. If your organization’s IBM Cognos Analytics service must be public facing due to your network architecture place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\n\n2. Block all unexpected outbound network traffic to prevent potentially propagating confidential/sensitive data spills due to malware/exploits running on/against the system.\n\n3. Ensure you have the latest version of IBM Cognos Analytics deployed as all prior versions of the application to date have been noted as vulnerable to multiple different attack methodologies."
},
{
"issueTypeId": "IBMWebSphereApplicationServer",
"remediationGuidance": "To secure IBM WebSphere Application Server instances, it is recommended to perform the following:\n\n1. Isolate IBM WebSphere Application Server instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all IBM WebSphere Application Server instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that IBM WebSphere Application Server instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on IBM WebSphere Application Server instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "IgniteRealtimeOpenfire",
"remediationGuidance": "If an attacker gains access to an exposed Ignite Realtime Openfire instance, they may be able to eavesdrop on conversations, steal sensitive information, or even take control of the server. This could lead to data breaches, compromised user accounts, and potentially significant financial and reputational damage to the affected organization.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Configure secure communication using SSL/TLS to encrypt communication between the Openfire server and clients, preventing unauthorized access to sensitive information.\n2. Implement access controls, such as role-based access control (RBAC), to restrict access to the server and its resources to authorized users only, reducing the risk of unauthorized access or data breaches.\n3. Configure firewall rules to restrict incoming and outgoing traffic to necessary ports and protocols, preventing malicious traffic from reaching the server and limiting the attack surface.\n4. Set strong authentication policies, including password complexity requirements, multi-factor authentication, and regular password expiration, to ensure that user accounts are secure and protected from brute-force attacks and other forms of unauthorized access.\n5. Monitor system logs for suspicious activity and set up alerts for potential security incidents, enabling quick detection and response to potential threats.\n6. Conduct regular security audits to identify and remediate vulnerabilities, ensuring that the Openfire server and associated systems remain secure over time.\n7. Keep the Openfire server and associated software up-to-date with the latest security patches and updates, ensuring that any known vulnerabilities are addressed in a timely manner."
},
{
"issueTypeId": "IkeV1Server",
"remediationGuidance": "IKEv1 is deprecated and should no longer be used. IKEv2 is a faster, more secure, and more reliable alternative. Details and reasoning behind the move from IKEv1 to IKEv2 can be found in the IETF https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-ikev1-algo-to-historic."
},
{
"issueTypeId": "ImapServer",
"remediationGuidance": "Some of IMAP&#39;s most glaring security issues are its unencrypted user login data transmission and lack of compatibility with modern authentication systems like MFA. Attackers often attempt brute-force authentication against IMAP by employing credential-spraying attacks, where weak or public passwords are enumerated to gain unauthorized access to the server.\n\nXpanse recommends taking the following steps to secure IMAP instances:\n1. Place IMAP instances behind a firewall to monitor and control e-mail server traffic.\n2. Implement IMAPS, which is IMAP with implicit TLS encryption over port 993. Using TLS will help keep user e-mail sessions more secure as traffic will be encrypted. Another option is using IMAP with explicit TLS over port 143, which allows traffic to be encrypted if both client and server support STARTTLS.\n3. Do not use third-party e-mail clients that don&#39;t support MFA, as MFA can be easily bypassed when attempting authentication."
},
{
"issueTypeId": "InsecureApacheAPISIX",
"remediationGuidance": "Apache APISIX is known to be vulnerable to authentication bypass and remote code execution attacks, most notably https://nvd.nist.gov/vuln/detail/cve-2022-24112, which could lead to malicious actors gaining access to the admin dashboard interface. These types of attacks could allow unauthorized users to bring services offline and/or extract critical information about an organization’s infrastructure.\n\nTo remediate instances affected by CVE-2022-24112, it is recommended to update APISIX to versions 2.12.1 or 2.10.4. This vulnerability can also be mitigated by explicitly commenting out batch-requests in the conf/config.yaml and conf/config-default.yaml files and restarting Apache APISIX.\n\nXpanse recommends securing instances of Apache APISIX by following these best practices:\n\n1. Place Apache APISIX gateways behind a web application firewall (WAF) and ensure that there are comprehensive rules in place to restrict access only to intended audiences.\n2. Ensure that Apache APISIX gateways are running on the latest version and implement a patch management process to facilitate applying security updates in a timely manner.\n3. Implement rate-limiting to prevent traffic overload and Distributed Denial of Service (DDoS) attacks.\n4. Enable robust logging and closely monitor ingress and egress traffic."
},
{
"issueTypeId": "InsecureApacheDruid",
"remediationGuidance": "It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\n\nXpanse recommends securing your database software by taking the following steps:\n\n1. Isolate the database from the public internet by placing it behind a VPN.\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "InsecureApacheWebServer",
"remediationGuidance": "1. Verify backported versions requires system access and cannot be accurately done from the Internet, it is recommended to confirm vulnerabilities on the system through a change log or other means.\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Apache Web Server and apply latest security updates. This can be done via https://httpd.apache.org/download.cgi.\n3. Ensure all files outside the document root are secured with &#39;require all denied&#39; in the server&#39;s configuration. Details on how to do so can be found at https://httpd.apache.org/docs/2.4/misc/security_tips.html."
},
{
"issueTypeId": "InsecureAppleCups",
"remediationGuidance": "1. CUPS servers should not be directly accessible from the internet as they pose a significant risk as vulnerabilities are constantly being found for the service. Evaluate if this CUPS server needs to be exposed to the public internet for business purposes.\n2. If the server does need to be exposed to the public internet or an internal network, Xpanse recommends reconfiguring the server to leverage the Internet Printing Protocol (IPP) along with Access Control Lists (ACL), authentication, and encrypted communication.\n3. Configuration of secure IPP can be found https://www.rfc-editor.org/rfc/rfc7472.html.\n4. Update to the latest secure version."
},
{
"issueTypeId": "InsecureAtlassianBamboo",
"remediationGuidance": "Successful exploitation of CVE-2022-26136 would allow a remote, unauthenticated attacker to bypass authentication or execute malicious Javascript in the browser by sending HTTP requests crafted so that either the authentication logic used by Servlet Filters from third party apps would not be invoked or by bypassing the Servlet Filters entirely. Exploitation of CVE-2022-26137 would involve gaining access to the Servlet Filter used to respond to CORS requests resulting in CORS bypass.\n\nAtlassian has not exhaustively determined all possible attack vectors for these two vulnerabilities, so the impact of exploitation could be even more severe than described.\n\nXpanse recommends using information surfaced by this policy to assess whether your organization’s Atlassian Bamboo Server is impacted and upgrade to the latest available patch if needed."
},
{
"issueTypeId": "InsecureAtlassianConfluenceDataCenter",
"remediationGuidance": "In certain versions of Confluence Server and Data Center threat actors are able to remotely execute arbitrary code and view restricted resources. To reduce the likelihood of such attempts, ensure the following:\n\n1. Best practice is to update to current versions, as outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Confluence Server and Data Center. Latest version can be found at https://www.atlassian.com/software/confluence/download-archives.\n2. If incremental updates cannot be achieved, there are temporary workarounds offered on Confluence Support under “Mitigation” at https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html#.\n3. Ensure Confluence Server and Data Center are not publicly accessible on the Internet and only on trusted local networks."
},
{
"issueTypeId": "InsecureAtlassianConfluenceServer",
"remediationGuidance": "In certain versions of Confluence Server and Data Center threat actors are able to remotely execute arbitrary code and view restricted resources. To reduce the likelihood of such attempts, ensure the following:\n\n1. Best practice is to update to current versions, as outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Confluence Server and Data Center. Latest version can be found at https://www.atlassian.com/software/confluence/download-archives.\n2. If incremental updates cannot be achieved, there are temporary workarounds offered on Confluence Support under “Mitigation” at https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html#.\n3. Ensure Confluence Server and Data Center are not publicly accessible on the Internet and only on trusted local networks."
},
{
"issueTypeId": "InsecureAtlassianCrowdServer",
"remediationGuidance": "CVE-2019-11580 is a remote code execution vulnerability while CVE-2022-43782 is an improper authentication vulnerability.\nIn order to remediate CVE-2019-11580, it is recommended to update to the latest secure version.\n\nIf that is not possible, the vulnerability can be remediated by performing the following:\n1. Stop Crowd\n2. Find and delete any pdkinstall-plugin jar files from the Crowd installation directory and the data directory\n3. Remove the pdkinstall-plugin jar file from /crowd-webapp/WEB-INF/classes/atlassian-bundled-plugins.zip\n4. Start Crowd\n5. Check that there are no pdkinstall-plugin jar files in the installation directory or the data directory.\n\nMore information regarding remediation guidance from Atlassian can be found https://jira.atlassian.com/browse/CWD-5388\n\nIn order to remediate CVE-2022-43782, it is recommended to update to any of the following fix versions: 4.4.4, 5.0.3, 5.1.0.\n\nMore information regarding how to remediate CVE-2022-43782 can be found https://jira.atlassian.com/browse/CWD-5888"
},
{
"issueTypeId": "InsecureAtlassianCrucible",
"remediationGuidance": "Identify the server or service owner of the affected asset and work to upgrade your Atlassian Crucible instance to version 4.8.9 or greater.\nVendor Advisory can be found https://jira.atlassian.com/browse/FE-7387"
},
{
"issueTypeId": "InsecureAtlassianFisheye",
"remediationGuidance": "Versions of Atlassian Fisheye 4.8.9 and below may be vulnerable to CVE-2021-43958, a vulnerability allowing an attacker to brute force user login credentials.\nXpanse recommends identifying the server or service owner of the affected asset and work to upgrade your Atlassian Fisheye instance to version 4.8.9 or greater.\nVendor Advisory can be found https://jira.atlassian.com/browse/FE-7387."
},
{
"issueTypeId": "InsecureAtlassianJiraServer",
"remediationGuidance": "If you have identified a vulnerable instance of Atlassian Jira, it is important to take immediate action to remediate the issue to prevent any potential security breaches. Here are some steps you can follow to remediate the issue:\n\n1. Disconnect the device from the network to prevent any potentially further compromise or lateral movement.\n2. Determine if any compromise of the device took place. If a compromise is discovered take the appropriate steps to contain, eradicate, and remediate the compromise(s).\n3. Apply the necessary patches or updates to your Atlassian Jira instance. Atlassian typically releases security patches for known vulnerabilities, so make sure to check their website for the latest updates.\n4. Review your security settings and make sure that your Atlassian Jira instance is configured correctly. This includes reviewing access controls, user permissions, and other security settings.\n5. Monitor your Atlassian Jira instance for any suspicious activity, such as unauthorized access attempts or unusual traffic patterns."
},
{
"issueTypeId": "InsecureAtlassianJiraServiceManagement",
"remediationGuidance": "In order to remediate instances of Jira Service Management that are vulnerable to CVE-2023-22501, the vendor recommends upgrading the affected instance to a patched version. If that cannot be accomplished, the vendor states that the version-specific servicedesk-variable-substitution-plugin JAR file can be upgraded as a temporary workaround. Recommended security guidelines that are not specific to CVE-2023-22501 are as follows:\n\n1. Quarantine the vulnerable server/application to prevent further potential exploits, lateral movement, data loss, or footholds in your environment.\n2. Identify the specific vulnerability affecting the instance of Jira Service Management.\n3. Once you have identified the vulnerability, apply any available patches or updates to the instance of Jira Service Management to remediate the vulnerability.\n4. Ensure that the instance of Jira Service Management is configured with appropriate security settings, such as SSL encryption, two-factor authentication, and access controls.\n5. Review logs associated with the device to include network logs, application logs, IPS/IDS logs, EDR logs, OS logs, etc. to determine if any compromise as a result of the vulnerable asset took place. Then contain, eradicate, and remediate appropriately.\n6. Continue to monitor all instances of Jira Service Management for future vulnerabilities and apply patches and updates as necessary to ensure ongoing proficient security.\n\nFor more information regarding CVE-2023-22501, please reference the following:\n* https://nvd.nist.gov/vuln/detail/CVE-2023-22501\n* https://confluence.atlassian.com/jira/jira-service-management-server-and-data-center-advisory-cve-2023-22501-1188786458.html"
},
{
"issueTypeId": "InsecureCactiNetworkMonitoringTool",
"remediationGuidance": "CVE-2022-46169 allows an unauthenticated attacker to remotely execute arbitrary code on a server running a vulnerable version of Cacti (up to and including 1.2.22).\n* It is recommended to patch the affected Cacti server to 1.2.23 or 1.3.0.\n* Further information can be found at the NVD entry listed https://nvd.nist.gov/vuln/detail/CVE-2022-46169."
},
{
"issueTypeId": "InsecureCiscoAdaptiveSecurityAppliance",
"remediationGuidance": "Due to the potential impact on business operations if this vulnerability is exploited, a number of steps should be followed to minimize risk:\n1. Investigate whether this instance of Cisco ASA must be accessible on the public facing internet. If the instance must be publicly accessible, ensure that the instance is actively monitored for malicious behavior.\n2. Determine if this specific instance is vulnerable to CVE-2022-29737. This can be done by visiting the https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-asa-ssl-vpn-heap-zLX3FdX.html.\n3. Apply the latest security patch."
},
{
"issueTypeId": "InsecureCiscoSecureAccessControlSystem",
"remediationGuidance": "Versions of Cisco Secure Access Control System flagged by this policy (versions prior to 5.8 patch 9) may be vulnerable to CVE-2018-0147, an insecure deserialization vulnerability that could lead to code execution.\nIn order to remediate, it is recommended to update the device&#39;s version that was flagged by this policy to a version greater than 5.8 patch 9.\nFurther information regarding the vulnerability and remediation recommendations can be found at the advisory from Cisco found https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2\nThe vendor recommends updating to the latest version of Secure Access Control System (ACS)."
},
{
"issueTypeId": "InsecureCiscoSmallBusinessRVSeriesRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "InsecureCiscoWirelessLanController",
"remediationGuidance": "Certain configurations of Cisco Wireless LAN Controller are susceptible to CVE-2022-20695, a critical authentication bypass vulnerability.\n\n1. Determine if this instance has the macfilter radius compatibility setting set to other.\n2. If it is set to other, the device is vulnerable.\n3. It is recommended to remove the device from the public facing internet until it can be upgraded to the latest secure version, or until the macfilter can be turned off.\n4. For more details on how to diagnose and remediate this issue, visit the https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-auth-bypass-JRNhV4fF."
},
{
"issueTypeId": "InsecureCitrixApplicationDeliveryController",
"remediationGuidance": "This policy will surface Citrix ADC web interfaces that are publicly accessible, which is not considered a best practice from a security standpoint, as it could serve as an entry point for attackers into a critical part of your infrastructure.\n\nXpanse recommends placing your organization’s ADCs behind a firewall and having robust logging to capture ADC traffic.\n\nTo protect against CVE-2022-27518, CVE-2019-19781, CVE-2023-3519, CVE-2023-3466, and CVE-2023-3467 upgrade to versions 13.1.49.13, 13.0.91.13, or 12.1.65.25.\n\nIt is also recommended to review results for both the regular and the insecure Citrix Application Delivery Controller policies in order to have a more holistic view of your organization’s attack surface."
},
{
"issueTypeId": "InsecureCitrixGateway",
"remediationGuidance": "If an attacker gains access to an exposed Citrix Gateway, they can potentially compromise the organization&#39;s security by accessing sensitive data, deploying malware, and disrupting operations. This unauthorized access can lead to widespread damage, including data theft, service disruptions, and harm to the organization&#39;s reputation and financial stability.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Ensure proper firewall configurations to restrict unauthorized access.\n2. Apply the latest security patches and updates.\n3. Enforce multi-factor authentication.\n4. Regularly review and adjust access control policies.\n\nMore information on security best practices can be found https://docs.netscaler.com/en-us/citrix-adc-secure-deployment.html#network-security.\n\nFurther information regarding the CVEs can be found on the vendor advisory https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467."
},
{
"issueTypeId": "InsecureCommunicationProtocol",
"remediationGuidance": "Enforcing strong transport layer security is an important step in securing an organization&#39;s attack surface. Using HTTPS ensures that all data is encrypted in transit and the certificate will help prevent impersonations. Best practice security recommendations include: \n\n1. Ensure all page redirects utilize HTTPS.\n\n2. Set the Strict-Transport-Security header and assign the max-age to two years (In this case, max-age would be set to 63072000). You should also include the preload directive. Depending on the configurations, you may also want to utilize the includeSubDomains directive."
},
{
"issueTypeId": "InsecureContentSecurity",
"remediationGuidance": "To secure the content on a webpage:\n\n1. Ensure all forms utilize HTTPS.\n\n2. Removed mixed content from a webpage. Mixed content opens up the website to sniffers and man-in-the-middle attacks.\n\n3. Set the Referrer-Policy header with the appropriate directive. For details on how this header works, visit the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy."
},
{
"issueTypeId": "InsecureCrestronAirMedia",
"remediationGuidance": "Crestron AM-100 and AM-101 are vulnerable to CVE-2019-3929, a critical command injection vulnerability. To secure this device, consider the following:\n\n1. Immediately remove access to this service until it can be upgraded.\n2. Upgrade to the latest secure version of AirMedia. For AM-100, upgrade to version 1.6.0.2 or later. For AM-101, upgrade to version 2.7.0.1 or later.\n3. Monitor for future vendor https://www.crestron.com/Security/Security-Advisories-All."
},
{
"issueTypeId": "InsecureDellEMCNetWorker",
"remediationGuidance": "If you have an exposed insecure instance of Dell EMC NetWorker, it is critical to take immediate action to prevent unauthorized access and data breaches. Here are some steps you can take to remediate the issue:\n\n1. Determine the level of vulnerability and whether any data has been compromised.\n2. Isolate the instance by disconnecting it from the network to prevent further unauthorized access.\n3. Review network and host logs to determine if any compromise took place. \n4. Update the Dell EMC NetWorker to the latest available version. This will ensure that any known vulnerabilities are patched.\n5. Change any default passwords on the Dell EMC NetWorker to strong, unique passwords.\n6. Review the access controls on the Dell EMC NetWorker to ensure that only authorized users have access.\n7. Monitor the instance for unusual activity to detect any potential breaches."
},
{
"issueTypeId": "InsecureDLinkDCS930L",
"remediationGuidance": "D-Link DCS-930L cameras are vulnerable to remote code execution and CSRF attacks, and depending on network topology, they can serve as an entry point into your organization’s network. This policy flags versions that are vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2016-11021.\n\nDue to the low attack complexity and the high risk for an unauthenticated attacker to perform remote code execution, Xpanse recommends patching DCS-930L to versions 2.12 and above."
},
{
"issueTypeId": "InsecureDrupalWebServer",
"remediationGuidance": "Insecure versions of Drupal Web Server have vulnerabilities that can span from Cross-Site Scripting (XSS) to Remote Code Execution.\n1. It is recommended to upgrade the asset flagged under this policy to the latest secure version of Drupal.\n2. Other recommendations, after the Drupal server has been updated, would be to move the asset flagged under this policy behind security tooling such as a Web Application Firewall (WAF) as well as enable appropriate logging and alerting.\n3. More in-depth secure configuration guidance can be found on Drupal&#39;s site https://www.drupal.org/security/secure-configuration"
},
{
"issueTypeId": "InsecureEclipseJettyWebServer",
"remediationGuidance": "Versions 9.4.27, 9.4.28, and 9.4.29 of Eclipse Jetty are vulnerable to several CVEs ranging from denial of service vulnerabilites to local privilege escalation.\n1. It is recommended to upgrade to the latest secure version of Eclipse Jetty in order to remediate these vulnerabilities.\n2. More information regarding security bulletins from Eclipse Jetty, as well as appropriate fix versions for the vulnerabilities, can be found https://www.eclipse.org/jetty/security_reports.php."
},
{
"issueTypeId": "InsecureEximMailTransferAgent",
"remediationGuidance": "To secure Exim Mail Transfer Agent instances, it is recommended to perform the following:\n\n1. Isolate Exim Mail Transfer Agent instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Exim Mail Transfer Agent instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Exim Mail Transfer Agent instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Exim Mail Transfer Agent instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "InsecureFatPipeIPVPN",
"remediationGuidance": "Certain FatPipe IPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to identify the asset owner.\n2. Work to patch the device to the latest secure version.\n3. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\n4. Further information regarding the vulnerability can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2021-27855."
},
{
"issueTypeId": "InsecureFatPipeMPVPN",
"remediationGuidance": "Certain FatPipe MPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to identify the asset owner.\n2. Work to patch the device to the latest secure version.\n3. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\n4. Further information regarding the vulnerability can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2021-27855."
},
{
"issueTypeId": "InsecureFatPipeWARP",
"remediationGuidance": "Certain FatPipe WARP devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\n\nIt is recommended to perform the following:\n1. Investigate the flagged device to identify the asset owner.\n2. Work to patch the device to the latest secure version.\n3. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\n4. Further information regarding the vulnerability can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2021-27855."
},
{
"issueTypeId": "InsecureFortraGoAnywhereManagedFileTransfer",
"remediationGuidance": "Fortra GoAnywhere Managed File Transfer (MFT) has been affected by numerous security vulnerabilities, including CVE-2023-0669. There are a number of steps that should be taken to ensure your organization remains secure.\n\n1. Determine if this asset must be publicly accessible. If there is not clear business need for this file transfer system to be publicly accessible (for example, if it were solely used for internal use) consider removing the service from the public internet.\n2. Upgrade MFT to version 7.1.2 or later."
},
{
"issueTypeId": "InsecureGlobalscapeEFT",
"remediationGuidance": "If an attacker gains access to an exposed Globalscape EFT instance, they could potentially steal sensitive data being transferred through the system, modify or delete files, and even gain access to other systems connected to the EFT instance.\nVersions of Globalscape EFT identified by this policy are 8.0.x up to 8.1.0.14 which are vulnerable to the following CVEs:\n* CVE-2023-2989 - Auth Bypass\n* CVE-2023-2990 - Denial of Service\n* CVE-2023-2991 - Remote Hard Drive Serial Number Disclosure\n\nIn order to remain secure, it is recommended to update the Globalscape EFT instance to the latest secure version.\n\nFor more broad remediation guidance, the following can be performed to remain secure:\n1. Ensure that the EFT instance is running the latest version with all necessary patches and updates.\n2. Configure the EFT instance to use secure protocols such as SFTP or HTTPS.\n3. Implement strong password policies and enable two-factor authentication.\n4. Configure firewalls and network access controls to limit access to the EFT instance to only authorized users and systems.\n5. Implement monitoring and logging to detect and alert on any suspicious activity.\n6. Regularly review and analyze logs and alerts to identify potential security issues.\n7. Conduct regular vulnerability scans and penetration testing to identify potential vulnerabilities and security gaps.\n8. Ensure that all employees are trained on secure file transfer practices, including how to detect and report suspicious activity.\n9. Implement security information and event management (SIEM) tools to aggregate and analyze security events across the organization.\n10. Implement encryption for data at rest and in transit to protect sensitive information from unauthorized access."
},
{
"issueTypeId": "InsecureGoogleWebFrameworkAngular",
"remediationGuidance": "This policy flags versions that have a vulnerability in the Comment Handler, as captured by https://nvd.nist.gov/vuln/detail/CVE-2021-4231. The Comment Handler does not perform appropriate security checks on user input, which could enable an attacker to engage in a cross-site scripting attack.\n\nIf running a vulnerable version, Xpanse recommends upgrading your version of Angular to 11.0.5 or 11.1.0-next.3."
},
{
"issueTypeId": "InsecureGrafana",
"remediationGuidance": "Grafana is vulnerable to a number of critical vulnerabilities, such as CVE-2022-31107, CVE-2022-26148, and CVE-2023-3128, which can lead to authentication bypass and exposed passwords.\n1. Update Grafana to the latest secure version.\n2. Validate that the information displayed in Grafana should be publicly accessible. If not, work with the asset owner to remove the Grafana instance from the public internet.\n3. For in-depth vendor recommendations, visit https://grafana.com/go/webinar/grafana-security-features/."
},
{
"issueTypeId": "InsecureGrandstreamNetworksUCM6200SeriesDevice",
"remediationGuidance": "Exploitation of CVE-2020-5722 can lead to executing shell commands as root on the affected device.\n\n1. It is recommended to upgrade the device to the latest secure version.\n2. More information regarding CVE-2020-5722 can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2020-5722."
},
{
"issueTypeId": "InsecureHclBigFixPlatform",
"remediationGuidance": "It is recommended to upgrade the affected asset&#39;s version of BigFix Platform to either 9.5.20 or 10.0.7.\nMore information can be found on the advisory released by HCL https://support.hcltechsw.com/csm?id&#61;kb_article&amp;sysparm_article&#61;KB0098998."
},
{
"issueTypeId": "InsecureHikvisionDevice",
"remediationGuidance": "CVE-2021-36260 is a command injection vulnerability found in Hikvision products. Utilizing this vulnerability, an attacker could use the flagged asset as an entry point into your network.\n1. It is recommended to upgrade the firmware of the flagged asset to the latest secure version to ensure the vulnerability is patched.\n2. The advisory released by Hikvision, as well as information regarding specifics around affected and resolved firmware versions, can be found https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/security-notification-command-injection-vulnerability-in-some-hikvision-products/"
},
{
"issueTypeId": "InsecureIBMCognosAnalytics",
"remediationGuidance": "Public facing instances of IBM Cognos Analytics are at far greater risk for exploitation due to multiple vulnerabilities and\n common attack methodologies. Additionally, hosting this service on your public facing infrastructure increases you attack surface and should be avoided if possible. Xpanse recommends restricting access to your IBM Cognos Analytics application by taking the following steps:\n\n1. If your organization’s IBM Cognos Analytics service must be public facing due to your network architecture place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\n\n2. Block all unexpected outbound network traffic to prevent potentially propagating confidential/sensitive data spills due to malware/exploits running on/against the system.\n\n3. Ensure you have the latest version of IBM Cognos Analytics deployed as all prior versions of the application to date have been noted as vulnerable to multiple different attack methodologies. If updating is not an option see below:\n\n\t* In response to https://exchange.xforce.ibmcloud.com/vulnerabilities/227591 ensure email communications to the hosting entity are filtered or blocked entirely. This can be done via port filtering on ports 25, 465, 995, 110, 993, and 143.\n\n\t* In response to https://exchange.xforce.ibmcloud.com/vulnerabilities/233571 configure WAF rules to block POST requests containing .XML files. Additionally, if possible configure IBM Cognos Analytics to either not accept XML files or to not parse/accept external XML entities. These can be identified by the keyword SYSTEM under a defined entity."
},
{
"issueTypeId": "InsecureIgniteRealtimeOpenfire",
"remediationGuidance": "Versions of Ignite Realtime Openfire identified by this policy are vulnerable to CVE-2023-32315, an administrative console authentication bypass vulnerability. This attack can permit an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.\n\nIt is recommended to update the affected instance to the latest secure version in order to remediate the vulnerability.\n\nFor more broad security recommendations, it is recommended to perform the following:\n1. Configure secure communication using SSL/TLS to encrypt communication between the Openfire server and clients, preventing unauthorized access to sensitive information.\n2. Implement access controls, such as role-based access control (RBAC), to restrict access to the server and its resources to authorized users only, reducing the risk of unauthorized access or data breaches.\n3. Configure firewall rules to restrict incoming and outgoing traffic to necessary ports and protocols, preventing malicious traffic from reaching the server and limiting the attack surface.\n4. Set strong authentication policies, including password complexity requirements, multi-factor authentication, and regular password expiration, to ensure that user accounts are secure and protected from brute-force attacks and other forms of unauthorized access.\n5. Monitor system logs for suspicious activity and set up alerts for potential security incidents, enabling quick detection and response to potential threats.\n6. Conduct regular security audits to identify and remediate vulnerabilities, ensuring that the Openfire server and associated systems remain secure over time.\n7. Keep the Openfire server and associated software up-to-date with the latest security patches and updates, ensuring that any known vulnerabilities are addressed in a timely manner."
},
{
"issueTypeId": "InsecureJoomlaCore",
"remediationGuidance": "CVE-2023-23754 and CVE-2023-23755 can lead to attackers gaining access to private information. Therefore, the following steps should be taken in order to remain secure:\n\n1. Immediately upgrade to the latest secure version of Joomla! Core. CVE-2023-23754 and CVE-2023-23755 require an upgrade to version 4.3.2 or higher.\n2. Evaluate whether this web server must be accessible on the public internet. If not, place the device behind a VPN or restrict access to approved devices.\n\nA full list of the latest security issues impacting Joomla! Core can be found on the https://developer.joomla.org/security-centre.html."
},
{
"issueTypeId": "InsecurejQueryUI",
"remediationGuidance": "This policy flags jQuery UI instances susceptible to CVE-2022-31160, a cross-site scripting (XSS) vulnerability. To remain secure, consider the following:\n\n1. Upgrade jQuery UI to version 1.13.2 or greater.\n2. Given jQuery UI has disclosed vulnerabilities involving XSS, Palo Alto Networks recommends enforcing strict input sanitation measures on webpages built with jQuery UI to prevent similar exploits.\n3. Ensure monitoring is configured to detect attacks such as cross-site scripting, cross-site request forgery, SQL injection, and other nefarious activities."
},
{
"issueTypeId": "InsecureLiferayPortal",
"remediationGuidance": "If you have identified an exposed and vulnerable instance of Liferay Portal, it is crucial to take immediate action to remediate the issue to prevent any potential security breaches. Here are some steps you can follow to remediate the issue:\n\n1. Quarantine the device from the network and other devices to prevent any further compromsise or lateral movement.\n2. Analyze the device and any available logs to determine if a compromise took place. If a compromise is discovered take the necessary steps to contain, eradicate, and remediate all impacted devices.\n3. Once you have identified the vulnerability, you should apply the necessary patches or updates to your Liferay Portal instance. Liferay typically releases security patches for known vulnerabilities, so make sure to check their website for the latest updates.\n4. Review your security posture and make sure that your Liferay Portal instance is configured correctly. This includes reviewing access controls, user permissions, and other security devices in your network.\n5. Monitor your Liferay Portal instance for any suspicious activity, such as unauthorized access attempts or unusual traffic patterns."
},
{
"issueTypeId": "InsecureLiteSpeedWebServer",
"remediationGuidance": "Although LiteSpeed comes with powerful out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing. Unit42 identified three new vulnerabilities in LiteSpeed Web Server in November 2022 and has detailed vulnerable versions in their https://unit42.paloaltonetworks.com/openlitespeed-vulnerabilities/.\n\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\n\n1. Validate the current running versions of LiteSpeed Enterprise in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\n2. Review the current LiteSpeed configuration(s) against the https://www.litespeedtech.com/docs/webserver/config to prevent misconfigurations that could lead to leaking sensitive data.\n3. Consider using LiteSpeed’s built-in WAF features to detect and filter malicious traffic.\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings.\n\nFor more detailed configuration information, please see the vendor’s https://www.litespeedtech.com/docs/webserver."
},
{
"issueTypeId": "InsecureMicrosoftExchangeServer",
"remediationGuidance": "1. To identify the version and build of Exchange follow this guidance from Microsoft. https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view&#61;exchserver-2019\n2. For end of life (EOL) versions of Exchange best practice is to immediately remove access to the internet as they no longer receive security updates and pose a significant security risk to the environment.\n3. For Exchange servers that are not end of life, best practice is to utilize Microsoft’s Best Practice Analyzer (BPA) and evaluate the results against internal policy and Microsoft’s best practices for Exchange.\n4. Microsoft offers Best Practice Analyzer (BPA) a tool that should be leveraged to scan existing Exchange servers for patching, security, and compliance to Microsoft Best Practices. https://docs.microsoft.com/en-us/windows-server/administration/server-manager/run-best-practices-analyzer-scans-and-manage-scan-results\n\nFor recommendations on CVE-2022-41040 and CVE-2022-41082, refer to the following guidance document released by Microsoft found https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/.\nThis remediation guidance will be updated as more information becomes available.\n\nFor more information on CVE-2022-41080 and CVE-2022-41082, refer to the following post from Microsoft found https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-8-2022-kb5019758-2b3b039b-68b9-4f35-9064-6b286f495b1d"
},
{
"issueTypeId": "InsecureMicrosoftIisWebServer",
"remediationGuidance": "1. End of life (EOL) and outdated versions of software no longer get security updates on a regular basis and are a prime target for attackers. It is recommended to upgrade to a supported version of Microsoft IIS Web Server and apply latest security updates from Microsoft. Supported versions can be found at https://docs.microsoft.com/en-us/lifecycle/products/internet-information-services-iis\n2. It is recommended to upgrade to the latest supported version and follow Microsoft IIS Web Server best practices. https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/iis-best-practices/ba-p/1241577\n3. Microsoft offers Best Practice Analyzer (BPA) a tool that should be leveraged to scan IIS servers for patching, security, and compliance to Microsoft Best Practices. https://docs.microsoft.com/en-us/windows-server/administration/server-manager/run-best-practices-analyzer-scans-and-manage-scan-results"
},
{
"issueTypeId": "InsecureMobileIronCore",
"remediationGuidance": "If you have identified an exposed and vulnerable instance of IVanti EPMM, formerly MobileIron Core, here are the steps you can take to remediate the exposed instance:\n\n1. Immediately isolate the vulnerable instance from the network to prevent further damage.\n2. Download and install the latest security patches for MobileIron Core. \n3. Conduct an investigation on the system to determine if a compromise took place. If a compromise took place determine the impact and take appropriate eradication and remediation steps to address the compromise.\n4. Change all default passwords and ensure that all user accounts have strong passwords.\n5. Monitor the system continuously for any suspicious activity and take immediate action if any security breaches are detected.\n\nAdditional Information: https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language&#61;en_US"
},
{
"issueTypeId": "InsecureMobileIronSentry",
"remediationGuidance": "This issue identifies insecure versions of MobileIron Sentry, specifically versions 9.18 and earlier which are vulnerable to CVE-2023-38035 as well as other CVEs. The vulnerability allows unauthenticated, remote attackers to access some sensitive APIs that are used to configure Ivanti Sentry on the administrator portal (MICS). As a best practice, it is recommended to update to the latest available version whenever possible.\n\nFor more broad remediation guidance, it is recommended to perform the following:\n1. Isolate the exposed instance from the network to prevent further damage.\n2. Assess the extent of the exposure and determine what data has been compromised.\n3. Identify the root cause of the exposure, such as a misconfiguration or a vulnerability.\n4. Apply patches or updates to fix the vulnerability or misconfiguration.\n5. Change all passwords and access keys associated with the exposed instance.\n6. Conduct a thorough security audit to identify any other potential vulnerabilities or exposures.\n7. Implement additional security measures such as multi-factor authentication, network segmentation, and access controls to prevent future exposures."
},
{
"issueTypeId": "InsecureNodeJs",
"remediationGuidance": "To remediate an exposed and vulnerable instance of Node.js, follow these steps:\n\n1. Quarantine the asset associated with the identification of this issue.\n2. Review network, application, host, IPS/IDS, etc. logs to determine if a compromise of the system/application took place.\n\ta. If a compromise has been observed, identify the root cause of the intrusion.\n\tb. Take necessary steps to contain, eradicate, remediate, and prevent future intrusions.\n3. Update your Node.js version to the latest stable release. This will ensure that you have the latest security patches and fixes.\n4. Review your code and make sure it is secure. Use best practices for coding and security, such as input validation, output encoding, and access control.\n5. Ensure you are using adequate security tools such as firewalls, intrusion detection systems, and antivirus software to protect your Node.js instance from attacks.\n6. Monitor your Node.js instance for any suspicious activity or unauthorized access.\n\nMore information regarding CVEs that affect Node.js can be found via NVD https://nvd.nist.gov/vuln/search/results?form_type&#61;Basic&amp;results_type&#61;overview&amp;query&#61;cpe%3A2.3%3Aa%3Anodejs%3Anode.js&amp;search_type&#61;all&amp;isCpeNameSearch&#61;false"
},
{
"issueTypeId": "InsecureNoviSurvey",
"remediationGuidance": "NoviSurvey is vulnerable to numerous CVEs, such as CVE-2023-29492, a critical remote code execution vulnerability. To ensure best security practices are being followed:\n\n1. Remove this server from the public internet.\n2. Upgrade to the latest secure version. To prevent CVE-2023-29492, upgrade to version 8.9.43676 or greater.\n3. After upgrading to the latest secure version, evaluate whether this instance should be placed back on the external internet.\n\nFor more information, view the https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx."
},
{
"issueTypeId": "InsecureOpenLiteSpeedWebServer",
"remediationGuidance": "Although OpenLiteSpeed comes with solid out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing.\n\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\n\n1. Validate the current running versions of OpenLiteSpeed in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\n2. Review the current OpenLiteSpeed configuration(s) against the https://openlitespeed.org/kb/ols-configuration-examples/ to prevent misconfigurations that could lead to leaking sensitive data.\n3. Consider using LiteSpeed’s built-in WAF features to detect and filter malicious traffic.\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings."
},
{
"issueTypeId": "InsecureOpenSSH",
"remediationGuidance": "OpenSSH versions under 9.3 allow for methods of remote code execution, privilege escalation, information disclosure and modification, as well as denial of service. When using OpenSSH ensure the following:\n\n1. Backported versions require system access and cannot be done accurately from the Internet, it is recommended to verify vulnerabilities on the system through a change log or other means.\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to a supported version of OpenSSH and apply latest security updates. Latest versions can be found at https://www.openssh.com/openbsd.html."
},
{
"issueTypeId": "InsecureOpenSSL",
"remediationGuidance": "OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. Outdated versions of OpenSSL are exploitable to multiple known vulnerabilities including CVE-2022-0778 that allows for Denial-of-Service (DoS).\n1. Backported versions require system access and cannot be done accurately from the internet, it is recommended to verify vulnerabilities on the system through a change log or other means.\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to a supported version of OpenSSL and apply latest security updates. Latest versions can be found at https://www.openssl.org/source/\n3. Mitigation and update guidance can also be found https://www.openssl.org/docs/man3.0/man7/migration_guide.html\n4. As more information regarding OpenSSL version 3.0.7 is released, this policy will be updated."
},
{
"issueTypeId": "InsecureOpenSSLCve20223602Cve20223786",
"remediationGuidance": "OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. OpenSSL versions 3.0.0 through 3.0.6 are vulnerable to a buffer overflow vulnerabilities CVE-2022-2062 and CVE-2022-3768. This may lead to remote code execution or denial-of-service.\n\n1. Backported versions require system access and cannot be done accurately from the internet. It is recommended to verify vulnerabilities on the system through a change log or other means.\n2. It is recommended to upgrade to a supported version of OpenSSL and apply latest security updates. Latest versions can be found at https://www.openssl.org/source/.\n3. This https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ contains impact and mitigation details."
},
{
"issueTypeId": "InsecureOraclePeopleSoftPeopleTools",
"remediationGuidance": "Oracle PeopleSoft PeopleTools when misconfigured and/or unpatched poses a security risk to your organization. Take the following steps to secure your instance of PeopleTools:\n\n1. Ensure your instance of PeopleTools is updated to the latest available version.\n2. Place PeopleTools behind security tools such as a WAF.\n3. Do not make access to PeopleTools public."
},
{
"issueTypeId": "InsecurePHP",
"remediationGuidance": "Identify the server or service owner of the affected asset and perform the following:\n\nIf your version falls under End of Life (EOL):\n1. Upgrade your PHP instance to a version that is actively supported\n\nIf your version receives security fixes but is still marked as insecure:\n1. Upgrade to an actively supported PHP version\n2. Upgrade to a PHP version that fixes the vulnerability your version falls under\n\nHelpful documentation on upgrading your instance (what has been depreciated or incompatibilities for older versions) can be found here: https://www.php.net/manual/en/migration80.php"
},
{
"issueTypeId": "InsecurePrimeTekPrimeFaces",
"remediationGuidance": "PrimeTek PrimeFaces version 5.x is vulnerable to CVE-2017-1000486 (a weak encryption flaw leading to remote code execution) and version 7.0.11 to CVE-2020-10544 (a cross-site scripting vulnerability).\nTo secure the server, ensure you are using the latest version of PrimeTek PrimeFaces."
},
{
"issueTypeId": "InsecurePulseSecurePulseConnectSecureVPN",
"remediationGuidance": "Unpatched and misconfigured Pulse Secure VPN Servers pose a serious security risk to any organization as severe vulnerabilities have been released including remote code execution (RCE) with a total of over 70 CVEs published for this device.\n\n1. Pulse Connect Secure VPN Servers should be patched as soon as possible to prevent active exploits from being successfully ran against these devices.\n2. VPN servers should be configured to include verbose logging to identify activities such as compromised account logins, anomalous geolocation based logins, brute force activity, injection attacks, impossible logins, single IPs hitting multiple accounts, and more.\n3. Ensure administration/backend portals for Pulse Connect Secure VPN are not publicly available.\n4. Ensure your IR plan for reacting to incidents involving your Pulse Connect Secure VPN include the ability to terminate sessions for users and deploy countermeasures in a swift timely manner.\n5. Based on your organization and the nature of it&#39;s business consider geolocation IP filtering for access to the user login interface.\n6. Consider blocking known TOR exit node traffic.\n7. If possible obfuscate the nature of the server/domain hosting Pulse Connect Secure VPNs by sanitizing applicable DNS records, server responses, and the domain name.\n8. Pulse Secure VPN Best Practices https://docs.pulsesecure.net/WebHelp/PDC/Migration%20Guides/NC_to_PDC/Content/Links_Network_Connect_to_Pulse_Desktop_Client_Migration_Guide/Considering_Best_Practices.htm."
},
{
"issueTypeId": "InsecurePythonApplication",
"remediationGuidance": "Insecure versions of Python are associated with various vulnerabilities such as access control bypass or remote code execution.\n\nIt is recommended to identify the asset owner and work with them to perform any of the following:\n1. Update the version of Python used by the application to a newer, secure version.\n2. If the version of python cannot be updated, work to remove the application from the internet.\n3. If the application cannot be removed from the internet, it is recommended to put the application behind a Web Application Firewall (WAF) or similar tool to help mitigate any attacks against the application."
},
{
"issueTypeId": "InsecureQuestKaceSystemManagementAppliance",
"remediationGuidance": "This policy flags instances of Quest KACE system management appliance that are vulnerable to CVE-2018-11138, a remote code execution vulnerability.\nIn order to remediate this vulnerability, it is recommended to upgrade the system to the latest secure version (above 8.0.318).\nThe CVE entry in NIST&#39;s National Vulnerability Database can be found https://nvd.nist.gov/vuln/detail/CVE-2018-11138"
},
{
"issueTypeId": "InsecureRoundcubeWebmail",
"remediationGuidance": "If an attacker gains access to an exposed Roundcube Webmail server, they could potentially compromise the entire email system, affecting multiple users and accounts. This could lead to unauthorized access to sensitive information, personal data, and contacts of all users on the server.\n\nIn order to remediate versions of Roundcube Webmail that are identified through this policy, the most important thing that can be done is to update to the latest secure version.\n\nFor more remediation guidance for Roundcube Webmail, see below:\n1. Regularly update the Roundcube Webmail software, plugins, and underlying server software to ensure that all known vulnerabilities are patched.\n2. Implement strong authentication mechanisms such as multi-factor authentication (MFA) and enforce the use of strong, unique passwords for all user accounts.\n3. Configure firewalls and access control lists (ACLs) to restrict incoming and outgoing traffic to the Roundcube Webmail server, allowing only necessary and trusted connections.\n4. Enable encryption (e.g., SSL/TLS) for both data in transit and at rest to protect sensitive information from unauthorized access and tampering.\n5. Perform regular security audits, vulnerability assessments, and monitor server logs to detect and respond to potential threats, unauthorized access, or suspicious activity in a timely manner."
},
{
"issueTypeId": "InsecureRubyOnRails",
"remediationGuidance": "CVE-2016-2098 allows remote attackers to execute arbitrary Ruby code by leveraging an application&#39;s unrestricted use of the render method for versions before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2. The vendor recommends updating to the latest version of Ruby on Rails."
},
{
"issueTypeId": "InsecureSecurityAndInfrastructureTechnologies",
"remediationGuidance": "1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\n\n2. Security and infrastructure are common targets for cyber criminals. Ensure that monitoring is enabled to detect abnormal traffic.\n\n3. If applicable, upgrade the device to the latest secure version.\n\n4. Check vendor recommendations for configuring and maintaining the service. If possible, set up monitoring for vendor security advisories."
},
{
"issueTypeId": "InsecureSignatureCertificate",
"remediationGuidance": "The use of weak algorithms is discouraged and presents security risks to organizations. It is recommended to use cipher suites that are considered secure such as SHA256, SHA384, SHA512, and ECDSA."
},
{
"issueTypeId": "InsecureSipServer",
"remediationGuidance": "Secure your SIP servers by taking the following precautions:\n\n1. This policy specifically flags SIP configurations that have enabled the OPTIONS method. It is recommended to disable this method unless absolutely necessary, because it allows attackers to gain information about a system and craft specific attack plans against a SIP device.\n2. Maintain SIP systems behind a firewall or through a VPN.\n3. If the SIP server needs to be exposed to the Internet, then using high-entropy passwords, lockout policy, and traffic inspection is recommended.\n4. Ensure that usernames are not based on extensions since most brute force attacks will attempt an extension match.\n\nFurther documentation: https://datatracker.ietf.org/doc/html/rfc3261#section-26.3"
},
{
"issueTypeId": "InsecureSolarWindsOrionPlatform",
"remediationGuidance": "The SolarWinds breach was a multi-part, sophisticated attack that involved the distribution of the SUNBURST backdoor. SUNBURST is a digitally signed malware that was embedded into a SolarWinds plugin, allowing attackers to move laterally within an organization’s network when the backdoor is executed. The impacted versions are 2019.4 HF 5,2020.2 with no patch installed or 2020.2 HF 1. If any of those versions are running, upgrading to 2020.2.1 HF 2 or above is imperative.\n\nSince SUNBURST is digitally signed and looks legitimate, assessing the impact of this intrusion could be complex. Follow CISA’s recommended process for remediating malicious activity caused by SUNBURST. Your organization can also investigate potential SUNBURST activity using the https://unit42.paloaltonetworks.com/atoms/solarstorm/\n\nFurther documentation: https://www.cisa.gov/uscert/ncas/current-activity/2021/03/09/guidance-remediating-networks-affected-solarwinds-and-active."
},
{
"issueTypeId": "InsecureSolarWindsServU",
"remediationGuidance": "In order to protect against CVE-2021-35211, in addition to other security vulnerabilities, ensure that SolarWinds Serv-U is running version 15.2.3 HF2 or later."
},
{
"issueTypeId": "InsecureSonicWallSonicOS",
"remediationGuidance": "Assets identified by this policy may be vulnerable to CVE-2020-5135, a vulnerability allowing a remote attacker to cause a Denial of Service (DoS).\nXpanse recommends identifying the affected asset or server owner and work with them to upgrade the version of SonicWall SonicOS to the latest secure version.\nMore details regarding the vulnerability can be found at the NIST NVD entry https://nvd.nist.gov/vuln/detail/CVE-2020-5135"
},
{
"issueTypeId": "InsecureSumavisionRouterEnhancedMultimediaRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "InsecureSynologyVPNPlusServer",
"remediationGuidance": "VPN clients should be monitored closely, as they can provide threat actors a foothold into an organization&#39;s network. Synology VPN Plus Server comes equipped with a number of different settings that can help secure the device:\n\n1. Upgrade to the latest secure version. For CVE-2022-43931, upgrade the device to version 1.4.3-0534 or 1.4.4-0635.\n2. Utilize VPN Plus Server&#39;s traffic monitoring functionality. Setup alerts that trigger on suspicious behavior.\n3. Carefully manage user permissions, and limit access to the VPN only to trusted users.\n4. Work with IT to ensure this device is using a secure protocol. Certain protocols may require more maintenance than others. For instance, it is recommended to not use PPTP due to security concerns."
},
{
"issueTypeId": "InsecureTelerikWebUI",
"remediationGuidance": "When left unpatched or misconfigured, Telerik Web UI components pose a serious security risk due multiple CVEs, such as CVE-2019-18935, which can lead to arbitrary file inclusion, arbitrary code execution, cross-site scripting, and directory traversal.\n\n1. Ensure your organization is running the latest updates for Telerik to prevent known/active exploits from being successfully ran against your Telerik based web UI components.\n2. Enable robust application and server logging to monitor for nefarious activities such as file inclusions, cross-site scripting, and arbitrary code execution."
},
{
"issueTypeId": "InsecureTibcoJasperServer",
"remediationGuidance": "TIBCO JasperServer is vulnerable to a number of CVEs, including CVE-2018-5430 and CVE-2018-18809, two improper path traversal vulnerabilities. Exploitation could lead to a threat actor viewing arbitrary files on the server. To best protect your organization:\n1. Configure the security settings in TIBCO JasperServer to restrict access to sensitive data and features. For example, limit user access to reports and dashboards based on their roles and responsibilities.\n2. Implement security best practices, such as strong passwords, two-factor authentication, and regular security audits. Train users on how to recognize and report security incidents.\n3. Monitor your TIBCO JasperServer instance for any unusual activity or signs of a security breach. Use logging and monitoring tools to track user activity and detect potential threats.\n4. Upgrade to the latest secure version of JasperServer."
},
{
"issueTypeId": "InsecureTLS",
"remediationGuidance": "Insecure versions of TLS are versions that are known to be crackable and are therefore unsafe to utilize.\n1. It is recommended to identify the asset owner of the device flagged through this policy and work to disable insecure versions of TLS.\n2. More information regarding detection, remediation, configuration and various tools for identification can be found at the NSA Github repository https://github.com/nsacyber/Mitigating-Obsolete-TLS"
},
{
"issueTypeId": "InsecureTLSStrict",
"remediationGuidance": "Disabling older and deprecated versions of protocols reduces the attack surface, and is recommended as a best practice for Internet facing targets.\nIt is recommended to identify all assets that utilize deprecated SSL/TLS configurations and upgrade to cipher suites that are considered secure.\n\nFollow additional guidance set forth by NIST as needed:\nhttps://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final"
},
{
"issueTypeId": "InsecureWebApplications",
"remediationGuidance": "1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\n\n2. If applicable, upgrade the web server to the latest secure version.\n\n3. Check vendor recommendations for configuring and maintaining the web application. If possible, set up monitoring for vendor security advisories."
},
{
"issueTypeId": "InsecureWebFrameworksAndLibraries",
"remediationGuidance": "1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\n\n2. If applicable, upgrade the framework or library to the latest secure version.\n\n3. When possible, refrain from using public CDNs to serve libraries.\n\n4. Check vendor recommendations for configuring and maintaining the web frameworks, libraries, and third-party services. If possible, set up monitoring for vendor security advisories."
},
{
"issueTypeId": "InsecureWebServerTechnologies",
"remediationGuidance": "1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\n\n2. If applicable, upgrade the web server to the latest secure version.\n\n3. Check vendor recommendations for configuring and maintaining the web server. If possible, set up monitoring for vendor security advisories."
},
{
"issueTypeId": "InsecureZohoManageEnginePasswordManagerPro",
"remediationGuidance": "Builds of Zoho ManageEngine Password Manager Pro that are flagged by this policy are vulnerable to CVE-2022-35405; a remote code execution vulnerability.\nIt is recommended to upgrade the flagged asset to build 12101 or later.\nThe vendor advisory regarding this vulnerability can be found https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html."
},
{
"issueTypeId": "InsecureZohoManageEngineServiceDeskPlus",
"remediationGuidance": "1. Evaluate if ManageEngine ServiceDesk Plus should be directly accessible from the internet. Apart from rare circumstances, ManageEngine ServiceDesk Plus should be deployed on an internal network.\n2. The Zoho ManageEngine ServiceDesk Plus Admin Guide gives detailed installation instructions. This includes how to install certificates, manage users, and log connections.\n3. Follow the Best Practices to help secure the application: https://download.manageengine.com/products/service-desk/servicedesk-plus-installation-best-practices-guide.pdf"
},
{
"issueTypeId": "IntelActiveManagementTechnology",
"remediationGuidance": "Exploitation of Intel Active Management Technology via CVE-2022-28697 and CVE-2022-30601 can lead to privilege escalation, while CVE-2022-30944 can lead to information disclosure.\nIt is recommended to follow the steps provided by Intel to address these CVEs: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html."
},
{
"issueTypeId": "InternalIPAddressAdvertisement",
"remediationGuidance": "Internal IP addresses (RFC 1918) should be obscured by firewalls or proxy servers. When leaked on the internet they provide potential attackers with a probable entry point.\n\n1. Internal IP addresses should not be visible from the internet.\n2. Identify the device that is leaking private internal IP addresses and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n3. Verify device configurations and ensure internal IP addresses are not being broadcast."
},
{
"issueTypeId": "InvalidCertificateChain",
"remediationGuidance": "In order to ensure the server is secure and available to users with different SSL implementations:\n1. Verify that each certificate in the chain is signed by the certificate after it.\n2. Correctly order the certificate chain. According to https://www.rfc-editor.org/rfc/rfc4346#section-7.4.2, certificate chains should be in descending order.\n3. Remove unnecessary certificates."
},
{
"issueTypeId": "JenkinsServer",
"remediationGuidance": "Mis-configured Jenkins servers may disclose sensitive information such as credentials and log files. To reduce the likelihood of such instances, verify the following:\n\n1. Verify that the Jenkins server is properly configured. Instructions on how to do so can be found at https://www.jenkins.io/doc/book/installing/initial-settings/.\n2. Best practice is to ensure Jenkins server is not publicly accessible on the Internet and only on trusted local networks.\n3. Ensure the Jenkins and plugins are up to date, information on how to do so can be found at https://www.jenkins.io/doc/book/managing/plugins/ and https://www.jenkins.io/download/.\n4. Review user permissions, specifically for JENKINS_HOME directory and build pipelines, and evaluate if all users must be included. Further, ensure users cannot elevate their permissions. There are various Jenkins plugins that can aid in doing so.\n5. Ensure credentials are securely stored. There are various Jenkins plugins that can aid in doing so."
},
{
"issueTypeId": "jQueryUI",
"remediationGuidance": "Unpatched and misconfigured jQuery UI poses a serious security risk to any organization. Severe vulnerabilities have been discovered which can lead to cross-site scripting (XSS).\n\n1. Given jQuery UI has disclosed vulnerabilities involving XSS, Palo Alto Networks recommends enforcing strict input sanitation measures on webpages built with jQuery UI to prevent similar exploits.\n\n2. Ensure monitoring is configured to detect attacks such as cross-site scripting, cross-site request forgery, SQL injection, and other nefarious activities."
},
{
"issueTypeId": "KaseyaVSA",
"remediationGuidance": "On July 3, 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) advised organizations to shut down all VSA servers as REvil ransomware began exploiting a zero day in Kaseya VSA to propagate ransomware."
},
{
"issueTypeId": "Kubernetes",
"remediationGuidance": "The Kubernetes control plane (also called API server) should not be directly accessible from the internet as they pose a serious security risk to any organization\n as severe vulnerabilities have been released. \n\n1. Identify the exposed Kubernetes server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Ensure that Kubernetes is configured to use TLS and Role Based Access Controls (RBAC). If for some reason the Kubernetes server must be exposed to the internet leverage MFA and place the server behind a Web Application Firewall (WAF).\n3. Kubernetes security best practices can be followed https://kubernetes.io/docs/concepts/security/"
},
{
"issueTypeId": "LDAPServer",
"remediationGuidance": "Exposed LDAP servers are vulnerable to various attack vectors, including LDAP injection, directory spoofing, and denial-of-service (DoS) attacks, which could lead to significant service interruptions or malicious actors gaining access to sensitive information.\n\nXpanse recommends taking the following steps to secure LDAP servers:\n\n1. Implement input sanitization and validation to prevent malicious code injection.\n2. Implement robust access control policies that follow the principle of least privilege.\n3. Enable TLS to protect data integrity.\n4. Automate identity provisioning and de-provisioning to prevent stale users and their associated credentials from being used in an insider threat attack.\n5. Place LDAP servers behind a VPN so that they’re no longer publicly accessible.\n6. Implement comprehensive monitoring and logging of LDAP operations to identify potential attacks"
},
{
"issueTypeId": "LiferayDigitalExperiencePlatform",
"remediationGuidance": "If you have identified an exposed and vulnerable instance of Liferay Digital Experience Platform (DXP), you should take immediate action to remediate the issue to prevent any potential security breaches. Here are the steps you can follow to remediate the issue:\n\n1. Disconnect the device from the network to prevent any potential further unauthorized access or exploit attempts.\n2. Review the system and its available logs to determine if any compromise took place on the system.\n3. Check if there are any available security patches or updates for your version of Liferay DXP. If there are, install them immediately to eliminate any known vulnerabilities.\n4. If you are using default credentials for your Liferay DXP instance, change them immediately to strong, unique passwords.\n5. If your instance of Liferay DXP must be public facing ensure it sits behind the appropriate security controls and that security best practices such as SSL/TLS encryption, MFA, and other restrictions are in place.\n6. Perform regular vulnerability scanning to identify any potential security issues in your Liferay DXP instance.\n7. Monitor your Liferay DXP instance for any suspicious activity, such as unauthorized access attempts or unusual traffic patterns. Additional information on how to secure your instance of Liferay DXP can be found https://learn.liferay.com/w/dxp/installation-and-upgrades/securing-liferay"
},
{
"issueTypeId": "LiferayPortal",
"remediationGuidance": "If attackers gain access to a publicly exposed Liferay portal instance, critical information could be leaked.\n\nTo secure Liferay Portal instances, it is recommended to perform the following:\n\n1. Isolate Liferay Portal instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Liferay Portal instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Liferay Portal instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Liferay Portal instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "LiteSpeedWebServer",
"remediationGuidance": "Although LiteSpeed comes with powerful out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing. Unit42 identified three new vulnerabilities in LiteSpeed Web Server in November 2022 and has detailed vulnerable versions in their https://unit42.paloaltonetworks.com/openlitespeed-vulnerabilities/.\n\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\n\n1. Validate the current running versions of LiteSpeed Enterprise in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\n2. Review the current LiteSpeed configuration(s) against the https://www.litespeedtech.com/docs/webserver/config to prevent misconfigurations that could lead to leaking sensitive data.\n3. Consider using LiteSpeed’s built-in WAF features to detect and filter malicious traffic.\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings.\n\nFor more detailed configuration information, please see the vendor’s https://www.litespeedtech.com/docs/webserver."
},
{
"issueTypeId": "Log4ShellVulnerableVMwareWorkspaceOneAccessServer",
"remediationGuidance": "Log4j is a popular java logging library. In late 2021, a critical exploit called Log4Shell was discovered that could potentially lead to arbitrary code execution. To protect against the Log4Shell exploit:\n\n* Determine if this instance of VMware Workspace ONE Access must be accessible on the public internet. If not, work with the asset owner to limit access.\n* Upgrade to the latest secure version."
},
{
"issueTypeId": "LongExpirationCertificate",
"remediationGuidance": "1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \n2. Identify all existing certificates and their expiration dates. For certificates with a validity period greater than 397 days follow established procedure to revoke and replace the certificate.\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions. https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html"
},
{
"issueTypeId": "Mattermost",
"remediationGuidance": "If an instance of Mattermost is unintentionally exposed, it is important to take immediate steps to remediate the issue to prevent unauthorized access or data breaches. Here are some steps that can be taken:\n\n1. Disconnect the server from the internet to prevent further access.\n2. Change all passwords and access keys associated with the instance of Mattermost.\n3. Investigate the cause of the exposure. Determine if any vulnerabilities were exploited or if any misconfigurations were present.\n4. Patch any vulnerabilities and fix any misconfigurations identified during the investigation.\n5. Perform a security audit of the system to ensure that it is properly secured.\n6. If any data was compromised, notify affected users and take steps to mitigate any potential harm.\n7. Once the issue has been resolved, determine a way to safely make the device accessible to users. One such way is placing it in your internal environment and allowing users to access the environment via a VPN.\n\nFor more information regarding security settings and configurations, please reference the vendor documentation found https://docs.mattermost.com/about/security.html."
},
{
"issueTypeId": "MemcachedServer",
"remediationGuidance": "Memcached systems may contain sensitive information and should not be externally accessible as they are not hardened against external attack.\nIt is recommended to remove the device from being publicly accessible from the internet.\nOther configuration options that are useful for securing the Memcached system are:\n1. Bind Memcached to a local interface\n2. Disable UDP on the Memcached system (Disabling TCP on the public interface is also recommended but can cause issues with accessing resources outside of the internal network)"
},
{
"issueTypeId": "MetaPixel",
"remediationGuidance": "The original intent behind the development of the Meta Pixel was to improve users’ advertising experience by comprehensively tracking their actions on websites and mapping that behavioral profile to customized, well-targeted advertising. Despite this innocuous intent, the Pixel has been involved in an increasing number of high-profile data breaches that led to PII and PHI data being accidentally leaked from healthcare systems, tax preparation websites, and education-related platforms.\n\nMeta Pixel breaches happen when the functions embedded in the Pixel collect sensitive user information (like medical information, IP address, address/location, etc.), which is then transmitted upstream to Meta, which will store and sell this data to advertisers. Since the Pixel is so easily misconfigured, having Meta Pixel configured on your organization’s assets carries a significant risk of an unintended data breach that could violate HIPAA or privacy laws.\n\nDue to these concerns, Xpanse recommends removing the Meta Pixel from all assets flagged by this policy."
},
{
"issueTypeId": "MicrofocusAccessManager",
"remediationGuidance": "To secure Microfocus Access Manager instances, it is recommended to perform the following:\n\n1. Isolate Microfocus Access Manager instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Microfocus Access Manager instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Microfocus Access Manager instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Microfocus Access Manager instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "MicrosoftDnsServer",
"remediationGuidance": "Microsoft DNS Servers can potentially be exploited in various ways with repercussions ranging from information disclosure to remote code execution (RCE).\nMicrosoft has a free training module around securing Windows Server DNS that can be found https://learn.microsoft.com/en-us/training/modules/secure-windows-server-domain-name-system/."
},
{
"issueTypeId": "MicrosoftExchangeServer",
"remediationGuidance": "Due to the number and severity of recent vulnerabilities it is imperative to identify all on-premises Microsoft Exchange Servers and ensure they are fully patched and security hardened.\n\n1. To identify the version and build of Exchange follow this guidance from Microsoft https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view&#61;exchserver-2019.\n2. For end of life (EOL) versions of Exchange best practice is to immediately remove access to the internet as they no longer receive security updates and pose a significant security risk to the environment.\n3. For Exchange servers that are not end of life, best practice is to utilize Microsoft’s Best Practice Analyzer (BPA) and evaluate the results against internal policy and Microsoft’s best practices for Exchange.\n4. Microsoft offers Best Practice Analyzer (BPA) a tool that should be leveraged to scan existing Exchange servers for patching, security, and compliance to Microsoft Best Practices. It can be found https://docs.microsoft.com/en-us/windows-server/administration/server-manager/run-best-practices-analyzer-scans-and-manage-scan-results."
},
{
"issueTypeId": "MicrosoftOWAServer",
"remediationGuidance": "1. Best practice is to ensure Multi Factor Authentication (MFA) is being used on Outlook Web Access (OWA) and Office365. Guidance from microsoft can be found here. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view&#61;o365-worldwide\n2. If in use, verify Microsoft Exchanger Server is running supported versions and apply latest security updates from Microsoft. End of Life (EOL) and outdated versions of software no longer get security updates on a regular basis and are a prime target for attackers.\n3. Permit Outlook Web Access and Office365 access only through a secure Virtual Private Network (VPN) connection. Guidance from Microsoft can be found here. https://docs.microsoft.com/en-us/microsoft-365/solutions/empower-people-to-work-remotely-remote-access?view&#61;o365-worldwide\n4. Review group policies and evaluate if all users must be included in sensitive roles. "
},
{
"issueTypeId": "MicrosoftRDPWebClient",
"remediationGuidance": "RDP attacks are one of the most common attack vectors, and they are known to lead to devastating breaches. RDP access is often sold on the dark web, and breaches can go undetected for a long time. A successful attack against the RDP web client could lead to malicious actors gaining unauthorized access to internal systems, running network reconnaissance, or, at a minimum, allowing them to collect sensitive information used later to stage a more significant, impactful attack.\n\nRecommendations to reduce the likelihood of malicious RDP attempts are as follows:\n\n1. A best practice is not to have RDP publicly accessible on the internet and instead only on trusted local networks.\n2. Implement a risk-based approach that prioritizes patching RDP vulnerabilities with known weaponized public exploits.\n3. Limit RDP access to a specific user group and implementing lockout policies is an additional measure to protect against RDP brute-forcing, which is another common tactic used by attackers. In addition, enable NLA (Network Level Authentication) which is non-default on older versions.\n4. If remote access to RDP or terminal services is a business requirement, it should only be made accessible through a secure Virtual Private Network (VPN) connection with multi-factor authentication (MFA) to the corporate network or through a zero-trust remote access gateway."
},
{
"issueTypeId": "MicrosoftWindowsServer2000",
"remediationGuidance": "Microsoft Windows Server 2000 has not been supported by Microsoft since 2010 and it is no longer receiving security updates. It is recommended to upgrade to a newer versions of Windows Server."
},
{
"issueTypeId": "MicrosoftWindowsServer2003",
"remediationGuidance": "Due to extended support for Server 2003 ending on July 14, 2015 it is recommended to upgrade instances of Windows Server 2003 to either the latest version or one that is still receiving support (updates and security patches) from Microsoft or remove these assets from the internet entirely.\nInformation on doing to can be found at https://docs.microsoft.com/en-us/windows-server/get-started/install-upgrade-migrate"
},
{
"issueTypeId": "MicrosoftWindowsServer2012R2",
"remediationGuidance": "Microsoft Windows Server 2012 R2 when left unpatched or misconfigured poses a serious security risk to your organization. Palo Alto Networks recommends the following remediation actions:\n\n1.Ensure your instance of Microsoft Windows Server 2012 R2 is on the latest version to reduce the risk of an exploit being successfully ran against this OS.\n2.Ensure access to this resource is properly restricted by taking measures such as dual-homing the device and placing the login interface on the private IP address range only.\n3.Place this device behind security devices in your network such as a WAF and enable robust logging on the asset."
},
{
"issueTypeId": "MikroTikRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "MinIO",
"remediationGuidance": "If an attacker gains access to an exposed MinIO server, they can potentially compromise sensitive data stored within the server, such as personal information, confidential documents, or proprietary assets. The attacker may also alter, delete, or generally disrupt business operations.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Implement network segmentation by isolating the MinIO server behind a firewall, allowing only necessary traffic to reach the server.\n2. Set up strong authentication and authorization mechanisms, such as access keys and bucket policies, to restrict access only to authorized users.\n3. Regularly update the MinIO server software to ensure it&#39;s protected against known vulnerabilities and running the latest security features.\n4. Enable encryption for data transmission (e.g., HTTPS) and storage (e.g., server-side or client-side encryption) to safeguard sensitive data from unauthorized access.\n5. Monitor the MinIO server using logging and intrusion detection tools to detect and respond to suspicious activities, and routinely review access logs and server configurations to maintain security best practices.\n\nMore information regarding secure configurations and best practices can be found https://min.io/docs/minio/container/administration/identity-access-management.html"
},
{
"issueTypeId": "MisconfiguredCrossSiteProtections",
"remediationGuidance": "Cross-site scripting is a common, yet dangerous attack vector. There are a number of ways for websites to protect against cross-site scripting: \n\n1. Set the X-Frame-Options header to either DENY or SAMEORIGIN. Alternatively, set the Content-Security-Policy frame-ancestors directive. Setting this option will help prevent click-jacking. \n\n2. Set the X-Content-Type-Options header to nosniff. This prevents MIME type sniffing, which could lead to security concerns if the content-type is executable. \n\n3. The Content-Security-Policy (CSP) header mitigates certain XSS and data injection attacks. Details on how to configure a policy can be found on the https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#writing_a_policy. \n\n4. Permissions-Policy works similarly to CSP, and can be a great way to further secure specific elements of a webpage. Detailed documentation on how this header works can be found on the https://developer.mozilla.org/en-US/docs/Web/HTTP/Permissions_Policy. \n\n5. Cross-Origin Resource Sharing (CORS) specifies to a browser where it should load resources from. There are a number of HTTP headers based on CORS, including Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Allow-Credentials, Access-Control-Allow-Methods, Access-Control-Allow-Headers. For a full list of headers, and suggested configurations, visit the https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#the_http_response_headers."
},
{
"issueTypeId": "MissingContentSecurityPolicyHeader",
"remediationGuidance": "Omitting Content Security Policy header leaves web servers vulnerable to data theft and data injection. To reduce the likelihood of such attempts, Xpanse suggests adding Content-Security-Policy (CSP) HTTP response headers to your web application. Information on how to do so can be found at https://content-security-policy.com/."
},
{
"issueTypeId": "MissingStrictTransportSecurityHeader",
"remediationGuidance": "When HTTP Strict Transport Security (HSTS) is not enabled, threat actors can run SSL stripping attacks, making all web connections unencrypted. It is recommended to enable HTTP Strict Transport Security (HSTS) by following these steps:\n\n**1. Add a Strict-Transport-Security response header to your application** with the value: max-age&#61;31536000. This will inform the browser that it should not allow that web application to be accessed over HTTP during the configured time. The max-age should be set to at least one year.\n**2. Add the includeSubDomains flag**, which will enforce HSTS at the subdomain level\n**3. Consider submitting your application’s domain to preload lists** to prevent SSL stripping attacks on first use. If any subdomains are expected to function over HTTP, preloading may not be a feasible solution as it will make those subdomains inaccessible.\n\nFurther documentation: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html"
},
{
"issueTypeId": "MissingXContentTypeOptionsHeader",
"remediationGuidance": "Identify the server or service owner of the flagged asset and perform the following:\nSet the X-Content-Type-Options HTTP header in the server configuration of the flagged asset to &#34;nosniff&#34;.\n\nFor information on specific configurations or other secure headers to utilize, see the following:\n1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options\n2. https://owasp.org/www-project-secure-headers/"
},
{
"issueTypeId": "MissingXFrameOptionsHeader",
"remediationGuidance": "1. Best practice is to enable the X-Frame-Options header with the value DENY or SAMEORIGIN.\n2. Evaluate the type of web server that is hosting the content with the missing X-Frame-Options header. Each web server has a slight configuration variation for X-Frame-Options headers. Mozilla has a good reference for each configuration.\nhttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options\n3. Along with the X-Frame-Options header, OWASP recommends a layered security approach. Leveraging a Content Security Policy (CSP), SameSite cookies, or JavaScript “Frame-Buster” code will help provide defense in-depth. \nhttps://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html"
},
{
"issueTypeId": "MissingXXssProtectionHeader",
"remediationGuidance": "Omitting the X-XSS-Protection header has the potential to leave web browsers vulnerable to XSS (Cross-Site Scripting) attacks. However, with modern browsers this can be mitigated with a strong Content-Security-Policy which disables the use of inline Javascript (&#39;unsafe-inline&#39;).\n1. If you do not need to support older browsers, utilize Content-Security-Policy without allowing &#39;unsafe-inline&#39; scripts instead.\n2. If you need to support older browsers, you can set this flag to any of the following depending on your need.\n2a: X-XSS-Protection: 1\n2b: This enables XSS filtering in the browser. The browser will render the page after the browser has sanitized the page if an attack is detected.\n2c: X-XSS-Protection: 1; mode&#61;block\n2d: This enables XSS filtering in the browser. The browser will prevent rendering of the page if an attack is detected.\n2e: X-XSS-Protection: 1; report&#61; (Chromium only)\n2f: This enables XSS filtering in the browser. The browser will render the page after the browser has sanitized the page if an attack is detected. The browser will then report the attack using the CSP &#39;report-uri&#39; directive to the reporting uri defined in the &#39;&#39; field above.\n\nFor more information on specific configurations and vulnerability information, please see the following:\nhttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection"
},
{
"issueTypeId": "MitelMiCollab",
"remediationGuidance": "To secure Mitel MiCollab instances, it is recommended to perform the following:\n\n1. Isolate Mitel MiCollab instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Mitel MiCollab instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Mitel MiCollab instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Mitel MiCollab instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "MitelMiVoice",
"remediationGuidance": "If attackers gain access to a publicly exposed Mitel MiVoice Business Express instance, an organization’s communication infrastructure could be breached and it could lead to leaks of sensitive proprietary information or could lead to significant communication interruptions.\n\nTo secure Mitel MiVoice Business Express instances, it is recommended to perform the following:\n\n1. Isolate Mitel MiVoice Business Express instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Mitel MiVoice Business Express instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Mitel MiVoice Business Express instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Mitel MiVoice Business Express instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "MobileIronCore",
"remediationGuidance": "To remediate an exposed instance of Ivanti Endpoint Manager Mobile, you should take the following steps:\n\n1. Immediately disconnect the affected system or network from the internet to prevent further unauthorized access or damage.\n2. Assess the extent of the exposure and determine the potential impact on the system, network, and data.\n3. Identify the cause of the exposure, such as a vulnerability or misconfiguration, and address it accordingly.\n4. If a vulnerability caused the exposure, apply the appropriate security patch or update to the Ivanti Endpoint Manager Mobile software to fix the vulnerability.\n5. Change all passwords and access credentials associated with the affected system or network.\n6. Conduct a thorough review of the system and any logs available for the system to determine if a compromise took place. If a compromise took place take the appropriate steps to effectively contain, eradicate, and remediate the compromise.\n7. Ensure appropriate security controls are in place such as firewalls, intrusion detection systems, and anti-virus software, to prevent future exposures."
},
{
"issueTypeId": "MobileIronSentry",
"remediationGuidance": "If an attacker were to gain access to an exposed MobileIron Sentry instance, they could potentially steal sensitive corporate data, such as emails, documents, and passwords.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the exposed instance from the network to prevent further damage.\n2. Assess the extent of the exposure and determine what data has been compromised.\n3. Identify the root cause of the exposure, such as a misconfiguration or a vulnerability.\n4. Apply patches or updates to fix the vulnerability or misconfiguration.\n5. Change all passwords and access keys associated with the exposed instance.\n6. Conduct a thorough security audit to identify any other potential vulnerabilities or exposures.\n7. Implement additional security measures such as multi-factor authentication, network segmentation, and access controls to prevent future exposures."
},
{
"issueTypeId": "MongoDBMongoExpress",
"remediationGuidance": "It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\n\nXpanse recommends securing your database software by taking the following steps:\n\n1. Isolate the database from the public internet by placing it behind a VPN.\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "MongoServer",
"remediationGuidance": "MongoDB servers and database servers in general should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\n\n1. Identify the exposed MongoDB server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Ensure that MongoDB is configured to use separate security credentials for each user and each process. It is recommended to enable Role Based Access Controls (RBAC) for all MongoDB instances.\n3. Leverage encryption either with TLS for data in transport or enable encryption at rest where the data is stored.\n4. Enable auditing and logging allowing for audit trails for future investigation.\n5. MongoDB server security best practices can be followed https://www.mongodb.com/docs/manual/administration/security-checklist/."
},
{
"issueTypeId": "MOVEitTransfer",
"remediationGuidance": "If an attacker gains access to a MOVEit Transfer server, they could potentially perform unauthorized actions, such as intercepting, modifying, or stealing sensitive data being transferred. They may also manipulate the system configuration, compromise user accounts, or disrupt the file transfer process.\n\nOn July 6th, 2023, Progress Software released a limited service pack that contains fixes for three newly disclosed vulnerabilities. CVE-2023-36934 and CVE-2023-36932 are SQL injection vulnerabilities that could lead to malicious actors gaining unauthorized access to the MoveIT Transfer database. These two vulnerabilities are considered critical because they can be exploited without authentication. CVE-2023-36933 is a vulnerability that could allow an attacker to cause significant service interruptions in MoveIT Transfer by invoking commands that would trigger unhandled exceptions. Xpanse recommends applying the newly published https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 that addresses these vulnerabilities.\n\nOther versions of MOVEit Transfer are also vulnerable to a critical SQL injection vulnerability (CVE-2023-34362) that can allow an attacker to gain unauthenticated access to the product&#39;s backend SQL database. It is recommended to review the security advisory posted by the vendor in order to determine if the server is vulnerable and how to remediate it. That advisory can be found https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.\n\nOther steps that can be taken to secure your MOVEit Transfer server are:\n1. Isolate the exposed MOVEit Transfer server from the rest of the network to minimize potential attack surfaces and limit the attacker&#39;s lateral movement.\n2. Ensure that the MOVEit Transfer server is running the latest software version and has all necessary security patches applied to address known vulnerabilities.\n3. Implement multi-factor authentication (MFA) for all user accounts accessing the server, and regularly review and update access privileges based on the principle of least privilege.\n4. Verify that all data transfers are encrypted both in transit and at rest, using strong encryption protocols like TLS and AES, to protect sensitive data from unauthorized access.\n5. Regularly monitor the server for any signs of intrusion or abnormal activity, using tools like intrusion detection systems (IDS) and security information and event management (SIEM) solutions, and have incident response plans in place to handle potential security breaches.\n\nFor more information on configuration of the product, please reference the documentation found https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2023/page/Start-Transferring-Files-and-Data.html."
},
{
"issueTypeId": "Moxa",
"remediationGuidance": "If an attacker gains access to a Moxa device, they could potentially compromise the security and integrity of the SCADA system and the connected industrial processes.\n\nIt is recommended to perform the following:\n1. Identify the exposed Moxa device\n2. Secure the device by changing the default password, disabling unnecessary services or features, and updating the firmware\n3. Review the device configuration and implement security best practices\n4. Implement network segmentation to isolate the Moxa device\n5. Monitor the device for any suspicious activity or attempted attacks\n\nAfter identifying the specific Moxa device, it is also recommended to consult the documentation for the product which can be found https://www.moxa.com/en/support/product-support/software-and-documentation."
},
{
"issueTypeId": "MoxaMXview",
"remediationGuidance": "Moxa MXview network management software is vulnerable to multiple critical CVEs such as CVE-2021-38452 (a path traversal vulnerability) and CVE-2021-38456 (a hardcoded password vulnerability).\nEnsure that the latest security patches for MXview are installed.\nVendor security advisories for MXview can be found https://www.moxa.com/en/support/product-support/security-advisory/security-advisories-all?psid&#61;53389."
},
{
"issueTypeId": "MssqlServer",
"remediationGuidance": "Publicly exposing your organization’s MSSQL servers increases the risk of being targeted by brute-force attacks. One recent example is the Vollgar campaign, a highly coordinated set of attacks believed to be originating from China that targeted publicly accessible MSSQL servers over the span of two years. It is recommended to restrict access to your MSSQL servers by taking the following steps:\n\n**1. Put your organization’s MSSQL server behind a firewall** and configure it to accept connections only on certain ports. Connections should be blocked on default database ports, like 1433, because those are usually the first line of attack.\n**2. Block all unexpected outbound network traffic** to prevent malware from phoning home; confidential data.\n**3. Disable SQL Server Browser service** to reduce your organization’s attack surface. The browser service uses UDP port 1434 and allows users to browse a list of current servers and connect to them and to administrator connection endpoints. By default, the browser service will expose the TCP port needed to connect to the MSSQL server, which is why it is recommended to specify the TCP port in the server’s connection strings.\n\nFurther documentation:\n * https://docs.microsoft.com/en-us/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access?view&#61;sql-server-ver16\n * https://docs.microsoft.com/en-us/sql/tools/configuration-manager/sql-server-browser-service?view&#61;sql-server-ver16"
},
{
"issueTypeId": "MulticastDnsServer",
"remediationGuidance": "An exposed multicast DNS (mDNS) server could allow an attacker to query information about your network. Therefore, mDNS servers should not be accessible on the public internet. If public exposure is necessary, consider whitelisting trusted devices and logging inbound traffic on port 5353."
},
{
"issueTypeId": "MysqlServer",
"remediationGuidance": "It is recommended that database servers are not made accessible to the public internet. In order to securely utilize a MySQL server:\n\n1. Do not transmit unencrypted data to and from the MySQL server. Instead, use an encrypted protocol such as SSL or SSH.\n2. Use a firewall to block all ingress and egress traffic from untrusted sources. If a web and database server are hosted on the same site, only expose the web server to the public internet. You can have traffic to and from the database server managed on a private LAN.\n3. Require all MySQL accounts to have an associated password. Ensure these passwords are complex enough to withstand attacks. Consider using MFA for additional security.\n4. Ensure you are running the latest version of MySQL server.\n\nFor additional security recommendations, visit https://dev.mysql.com/doc/refman/8.0/en/security.html"
},
{
"issueTypeId": "NetBiosNameServer",
"remediationGuidance": "NetBIOS is generally designed to be accessed by trusted clients inside trusted environments, therefore exposing NetBIOS directly to the Internet is not recommended.\n\n1. Best practice is to not have NetBIOS exposed to the Internet.\n2. Use a firewall to filter inbound connections to NetBIOS and only allow trusted IPs and hosts.\n3. Evaluate all devices utilizing NetBIOS and take a risk-based approach around the need for NetBIOS"
},
{
"issueTypeId": "NetGearDGNSeriesRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "NetGearProSafe",
"remediationGuidance": "NETGEAR ProSafe JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level (CVE-2020-26919). Further assessment is needed by organizations to infer vulnerability since this policy does not detect all of the necessary information to infer vulnerability."
},
{
"issueTypeId": "NetGearWNRSeriesRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "NetisRouter",
"remediationGuidance": "Routers and networking infrastructure are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "Netty",
"remediationGuidance": "Netty is vulnerable to CVE-2022-41881, a stack overflow vulnerability. Netty applications are expected to be public facing, however steps should be taken to ensure a secure version of Netty is used. This can be done by:\n\n1. Upgrading Netty to the latest secure version. Upgrade to version 4.1.86 or later to protect against CVE-2022-41881.\n2. Determine if this application needs to be removed from the public internet. If there is a business need to keep the application public, consider using a firewall or network access control list to restrict access to approved devices."
},
{
"issueTypeId": "NetworkingAndSecurityInfrastructure",
"remediationGuidance": "Although this policy does not solely identify administration panels, in general, networking infrastructure should not have its administration panels open to the public internet. Compromise of these devices, often through password guessing or vulnerability exploitation, may provide privileged access to an enterprise network.\n\nRouters and firewalls are expected to be internet facing. Ensure that they are actively monitored and receiving the latest security updates."
},
{
"issueTypeId": "NfsRpcBindServer",
"remediationGuidance": "Compromise of the rpcbind service could allow an adversary to query active services, and trigger unfreed memory allocations on the system leading to a remote Denial of Service. As a result, rpcbind should not be exposed to the public Internet.\nIt is recommended to identify the asset owner and working with them to remove the device from the internet as it should not be publicly accessible."
},
{
"issueTypeId": "NoviSurvey",
"remediationGuidance": "NoviSurvey is vulnerable to numerous CVEs, such as CVE-2023-29492, a critical remote code execution vulnerability. To ensure best security practices are being followed:\n\n1. Assess whether this instance of NoviSurvey should be publicly available. If the server should not be accessible to the public, place the server on an internal network or limit access to approved devices.\n2. Determine the current version of NoviSurvey. Upgrade to the latest secure version if necessary.\n3. Stay up-to-date with the latest releases and security advisories https://novisurvey.net/blog/blog-survey-software-news.aspx."
},
{
"issueTypeId": "OctoberCMS",
"remediationGuidance": "If an attacker gains access to an exposed October CMS server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization’s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the October CMS server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\n2. Regularly update the October CMS software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\n5. Monitor the October CMS server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices."
},
{
"issueTypeId": "OgwNonCompliantLongExpirationCertificate",
"remediationGuidance": "1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \n2. Identify all existing certificates and their expiration dates. For certificates with a validity period greater than 397 days follow established procedure to revoke and replace the certificate.\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions. https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html"
},
{
"issueTypeId": "OgwNonCompliantSelfSignedServerCertificate",
"remediationGuidance": "1. Devices directly accessible from the internet should not be utilizing self-signed certificates. Since these certificates lack signing by a certificate authority (CA) they cannot be revoked or verified easily.\n2. Identify the device with the self-signed certificate and identify if it should be accessible to the internet.\n3. To replace a self-signed certificate with one from a certificate authority it is best practice to follow guidelines from the manufacturer, vendor, or internal documentation as this process can vary widely."
},
{
"issueTypeId": "OGWNonCompliantWebServer",
"remediationGuidance": "When STS is not configured, threat actors can run SSL stripping attacks, making all web connections unencrypted. It is recommended to enable HTTP Strict Transport Security (HSTS) by following these steps:\n\n1. Add a Strict-Transport-Security response header to your application with the value: max-age&#61;31536000. This will inform the browser that it should not allow that web application to be accessed over HTTP during the configured time. The max age should be set to at least one year.\n2. Add the includeSubDomains flag, which will enforce HSTS at the subdomain level.\n3. Consider submitting your application’s domain to preload lists. Preloading is not a hard requirement in OGW directives, but preloading will prevent SSL stripping attacks on first use. Preloading may not be a feasible solution if any subdomains are expected to function over HTTP, as it will make those subdomains inaccessible.\n\nFurther documentation: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html."
},
{
"issueTypeId": "OGWNonCompliantWebServerDisallowedAlgorithms",
"remediationGuidance": "The weak or disallowed algorithms flagged by this policy are easily exploitable, and supporting them could lead to sensitive data leaks. These cipher suites should be disabled in favor of cryptographic algorithms that are considered secure, like SHA256, SHA384, SHA512, and ECDSA."
},
{
"issueTypeId": "OGWNonCompliantWebServerExpiredCertificate",
"remediationGuidance": "Applications with expired certificates are vulnerable to multiple attack vectors, the most serious being phishing and man-in-the-middle (MITM) attacks. Allowing an application to operate with expired certificates could cause significant reputational impact due to certificate outages and, in the worst scenario, could lead to a data breach.\n\nImplementing a centralized certificate management system to track all certificates in your organization is considered a best practice. Once visibility is gained into your organization’s certificate landscape, expiring or expired certificates must be re-issued.\n\nNIST’s guidance on https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html contains more information on establishing an effective certificate program and best practices for refreshing certificates."
},
{
"issueTypeId": "OGWNonCompliantWebServerInsecureCertificate",
"remediationGuidance": "MD5 and SHA-1 cryptographic hashing functions can be used to stage cryptographic collision attacks, which may enable malicious actors to compromise in a stealth manner communications that seem secure on the surface.\n\nThese types of attacks are notoriously challenging to detect, so it is recommended that all certificates using MD-5 and SHA-1 are replaced with certificates using more cryptographically robust hashes, like SHA-2 and SHA-3.\n\nCertificates with public key sizes less than 2048 bits are vulnerable to brute force attacks and considered cryptographically unhealthy. NIST recommends that public certificates have key sizes of 2048 or above.\n\nMore information on the attack vectors associated with MD-5 and SHA-1 can be found in https://www.rfc-editor.org/rfc/rfc4270, published by IETF.\n\nNIST’s https://csrc.nist.gov/projects/key-management/key-management-guidelines provides more information regarding current key management standards."
},
{
"issueTypeId": "OGWNonCompliantWebServerInsecureTLS",
"remediationGuidance": "The SSL/TLS versions flagged by this policy are famously insecure and increasingly less supported by modern browsers. The exploitation of these protocols could lead to attacks such as Padding Oracle On Downgraded Legacy Encryption (POODLE), Browser Exploit Against SSL/TLS (BEAST), and Compression Ratio Info-leak Made Easy (CRIME), which could lead to critical data leaks.\n\nComplying with OGW directives requires disabling TLS 1.0, TLS 1.1, SSL 2.0, and SSL 3.0."
},
{
"issueTypeId": "OPCUA",
"remediationGuidance": "If an attacker were to gain access to an OPC UA Discovery Server, they could potentially discover all the OPC UA enabled devices and applications in the network. This information could be used to launch targeted attacks against these devices or applications, potentially leading to unauthorized access, data theft, or even physical damage to industrial processes.\n\nIt is recommended to perform the following:\n1. Identify and document all devices and applications that are exposed by the Discovery Server.\n2. Verify that the Discovery Server is properly configured and secured, and that it&#39;s only accessible to authorized personnel.\n3. Patch any known vulnerabilities on the Discovery Server and all exposed devices and applications.\n4. Implement strong access controls, including multi-factor authentication and role-based access control, to restrict access to the Discovery Server and all exposed devices and applications.\n5. Monitor the Discovery Server and all exposed devices and applications for any suspicious activity, using intrusion detection systems and security information and event management (SIEM) tools.\n\nDocumentation on OPC UA can be found on the OPC Foundation&#39;s site https://reference.opcfoundation.org/"
},
{
"issueTypeId": "OpenBgpServer",
"remediationGuidance": "BGP servers are naturally exposed to the internet as they allow for routing between networks. BGP servers, if not properly secured, can result in malicious rerouting of internet traffic and eavesdropping.\n\n1. Identify the exposed BGP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Identify the manufacturer of the BGP appliance and ensure it is fully patched.\n3. BGP server security best practices from the NSA can be followed https://www.nsa.gov/portals/75/documents/what-we-do/cybersecurity/professional-resources/ctr-guide-to-border-gateway-protocol-best-practices.pdf.\n4. NIST has also released special guidance on securing the internet including DDoS protection for BGP https://csrc.nist.gov/publications/detail/sp/800-189/final."
},
{
"issueTypeId": "OpenLiteSpeedWebServer",
"remediationGuidance": "Although OpenLiteSpeed comes with solid out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing.\n\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\n\n1. Validate the current running versions of OpenLiteSpeed in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\n2. Review the current OpenLiteSpeed configuration(s) against the https://openlitespeed.org/kb/ols-configuration-examples/ to prevent misconfigurations that could lead to leaking sensitive data.\n3. Consider using LiteSpeed’s built-in WAF features to detect and filter malicious traffic.\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings."
},
{
"issueTypeId": "OpenSSL",
"remediationGuidance": "OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. Outdated versions of OpenSSL are exploitable to multiple known vulnerabilities including CVE-2022-0778 that allows for Denial-of-Service (DoS).\n1. Backported versions require system access and cannot be done accurately from the internet, it is recommended to verify vulnerabilities on the system through a change log or other means.\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to a supported version of OpenSSL and apply latest security updates. Latest versions can be found at https://www.openssl.org/source/\n3. Mitigation and update guidance can also be found https://www.openssl.org/docs/man3.0/man7/migration_guide.html"
},
{
"issueTypeId": "OpenVPNAdminPortal",
"remediationGuidance": "While OpenVPN servers are expected to be found on the public internet, a publicly accessible admin portal will likely be targeted by attackers. To improve your security posture consider the following options:\n\n* Disable the admin UI port in the network setting page. By default, this will restrict access of the admin portal to TCP port 943.\n* Consider serving the admin portal on a different port. Then, use a firewall to limit access to the port to approved devices.\n* Utilize defense mechanisms to mitigate against brute-force and dictionary attacks. Common strategies include enforcing strong passwords, utilizing lockouts, and sending notifications on successive failed attempts."
},
{
"issueTypeId": "OracleAccessManagement",
"remediationGuidance": "Oracle Access Management has frequently been susceptible to vulnerabilities that allow unauthenticated attackers to access and manipulate critical data, https://nvd.nist.gov/vuln/detail/CVE-2022-39412 and https://nvd.nist.gov/vuln/detail/CVE-2022-39405 being the most recent examples.\n\nXpanse recommends staying apprised of https://www.oracle.com/security-alerts/ for OAM and applying critical patches as soon as possible if your version of OAM is affected. Organizations are also strongly encouraged to review in-depth Oracle’s recommended security best practices for OAM, guidelines which can be found https://docs.oracle.com/en/middleware/idm/access-manager/12.2.1.3/aiaag/."
},
{
"issueTypeId": "OracleEBusinessSuite",
"remediationGuidance": "If an attacker gains access to an Oracle E-Business Suite server, they can potentially steal sensitive data such as customer information, financial records, or intellectual property. They can modify, delete, or corrupt data, which can disrupt business operations and cause significant financial and reputational damage.\n\nIt is recommended to perform the following in order to remain secure:\n\n1. Update your system: Look for any available updates from Oracle and apply them to your system. This will make sure any known issues are fixed and your system is up-to-date.\n\n2. Turn off unnecessary services: Check your installed services and turn off any that you don&#39;t need. This will reduce your system&#39;s exposure to attacks and limit the number of potential problems.\n\n3. Make your system secure: Make sure your system is configured properly and securely. This includes changing default passwords, disabling unnecessary accounts, and making sure passwords are strong.\n\n4. Check for problems often: Regularly scan your system for vulnerabilities so you can find any problems before they are exploited.\n\n5. Control who has access: Limit access to sensitive data and functions to prevent unauthorized access and limit the damage of any security breaches.\n\nOracle&#39;s documentation for E-Business Suite can be found https://docs.oracle.com/cd/E51111_01/current/html/docset.html."
},
{
"issueTypeId": "OracleOPERA",
"remediationGuidance": "If an instance of Oracle OPERA is found to be exposed and vulnerable, it is important to take immediate action to remediate the issue. Here are some steps that can be taken:\n\n1. Isolate the vulnerable system from the rest of the network to prevent further potential attacks or lateral movement.\n2. Identify any specific vulnerabilities and apply any available patches provided by Oracle. This may involve updating the software to a more recent version.\n3. Review the security controls in place and update them if necessary. This may include implementing additional access controls, updating firewall rules, and reviewing user permissions.\n4. Conduct a security assessment to determine if compromise of the system took place.\n5. Monitor the system for any signs of suspicious activity or attempts to exploit the vulnerability."
},
{
"issueTypeId": "OracleSolaris",
"remediationGuidance": "Per CISA&#39;s https://www.cisa.gov/news-events/alerts/2023/07/18/oracle-releases-security-updates, Xpanse recommends staying up-to-date on applying patches to Oracle Solaris."
},
{
"issueTypeId": "OracleWebLogicServer",
"remediationGuidance": "Multiple classes of vulnerabilities affect Oracle Web Logic Servers (such as Remote Code Execution or Denial of Service).\nIt is recommended to identify the asset owner and verify that the Oracle Web Logic Server needs to be exposed to the internet. If not, work with them to remove it.\nIf the Oracle Web Logic Server needs to be exposed to the internet, it is recommended to take a look at Oracle&#39;s documentation on security hardening found https://docs.oracle.com/cd/F30719_01/DESG/Content/hardening.htm\nIt is also recommended to place the server behind security controls such as a Web Application Firewall (WAF)."
},
{
"issueTypeId": "OutdatedNginxWebServer",
"remediationGuidance": "Identify the asset owner and work with them to update the server to a stable and secure version.\nUpgrade instructions can be found here: https://nginx.org/en/docs/install.html\nNote: Be sure to back up your NGINX configuration before proceeding with the update."
},
{
"issueTypeId": "PaloAltoNetworksFirewallAdminLoginPage",
"remediationGuidance": "Identify the owner of the affected asset and work with them to perform the following:\nRemove the admin login page from the internet. For more details on how this may be accomplished (as well as other best practices for hardening your firewall&#39;s admin access), please reference the following document:\nhttps://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/getting-started/best-practices-for-securing-administrative-access\n\nNote the version in the document shown on the page and ensure it matches the version your firewall is running."
},
{
"issueTypeId": "PaloAltoNetworksGlobalProtect",
"remediationGuidance": "VPN devices are often publicly accessible and, as a result, are a frequent target of sophisticated attacks. GlobalProtect is vulnerable to several high-impact vulnerabilities (for example, https://nvd.nist.gov/vuln/detail/CVE-2022-0017 and https://nvd.nist.gov/vuln/detail/CVE-2022-0017) that could lead to unauthenticated attackers performing vertical privilege escalation or remote code execution. To secure your instances of Global Protect, Xpanse recommends implementing a Zero-Trust architecture and staying up-to-date on the latest patches:\n\n1. Create a security zone for all VPN traffic using the GlobalProtect configuration options. Using security zones is a security best practice for VPNs because it creates a tunnel interface and gives organizations visibility into the IP pools used for remote users. This zero-trust approach helps with proactively detecting intruders and containing attacks for remote users. Please note that split tunneling is not recommended as it may lead to critical data being intercepted by malicious actors.\n2. Create NAT policies to secure traffic from the VPN security zone and use user groups and application IDs to reduce your organization’s attack surface.\n3. Closely monitor traffic logs by looking at the egress traffic captured in ACC (App Command Center)\n4. Ensure that disabling GlobalProtect is only allowed for a short interval of time (the default timeout is 30 min)\n5. Enable 2FA for all users\n6. Enable HIP (Host Information Profile) data collection to collect host-based data and apply that to your firewall (which helps with policy enforcement). You can also implement custom checks to verify specific security requirements (e.g., OS patch level) before allowing connections to critical resources.\n\nMore information can be found in the https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect."
},
{
"issueTypeId": "PanOsDevice",
"remediationGuidance": "Management interfaces should not be accessible on the public internet. They are frequently targeted in attacks, and could allow an attacker to gain access to a network. If the management interface must be accessible outside of the intranet, consider using an access control list or utilizing a VPN."
},
{
"issueTypeId": "PaperCutMF",
"remediationGuidance": "If an attacker gains access to PaperCut MF, they may exploit printing, copying, scanning, and faxing resources, access sensitive information in documents, modify usage quotas and restrictions, and disrupt the operation of multi-function devices.\n\nPaperCut MF is affected by CVE-2023-27350 which allows attackers to execute malicious code remotely and without authentication.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Verify the version of PaperCut MF that the service is running.\n2. If the version being ran is vulnerable to CVE-2023-27350, it is recommended to upgrade to the latest secure version. More information regarding patches and remediation can be found on the advisory posted by PaperCut https://www.papercut.com/kb/Main/PO-1216-and-PO-1219.\n\nOther important security steps to follow are:\n1. Restrict access to authorized users and devices using firewalls and access control lists.\n2. Implement strong authentication methods, such as two-factor authentication.\n3. Encrypt communication between clients and PaperCut MF using SSL/TLS.\n4. Regularly review user access, configurations, and security settings for compliance.\n5. Continuously monitor and log PaperCut MF-related activities to detect and respond to threats."
},
{
"issueTypeId": "PaperCutMobility",
"remediationGuidance": "If an attacker gains access to a PaperCut Mobility server, they may exploit print resources, intercept sensitive information in documents being printed, and disrupt mobile printing operations.\n\nPaperCut MF and PaperCut NG are affected by CVE-2023-27350 which allows attackers to execute malicious code remotely and without authentication.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Verify the version of PaperCut that the service is running.\n2. If the version being ran is vulnerable to CVE-2023-27350, it is recommended to upgrade to the latest secure version. More information regarding patches and remediation can be found on the advisory posted by PaperCut https://www.papercut.com/kb/Main/PO-1216-and-PO-1219.\n\nOther important security steps to follow are:\n1. Restrict access to authorized users and devices using firewalls and access control lists.\n2. Implement strong authentication methods, such as two-factor authentication, for mobile devices.\n3. Encrypt communication between mobile devices and the PaperCut Mobility server using SSL/TLS.\n4. Regularly review user access, configurations, and security settings for compliance.\n5. Continuously monitor and log PaperCut Mobility-related activities to detect and respond to threats."
},
{
"issueTypeId": "PaperCutNG",
"remediationGuidance": "If an attacker gains access to PaperCut NG, they can potentially misuse printing resources, access sensitive information in printed documents, alter print quotas and restrictions, and disrupt printing services.\n\nPaperCut NG is affected by CVE-2023-27350 which allows attackers to execute malicious code remotely and without authentication.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Verify the version of PaperCut NG that the service is running.\n2. If the version being ran is vulnerable to CVE-2023-27350, it is recommended to upgrade to the latest secure version. More information regarding patches and remediation can be found on the advisory posted by PaperCut https://www.papercut.com/kb/Main/PO-1216-and-PO-1219.\n\nOther important security steps to follow are:\n1. Limit access to the PaperCut NG service to authorized users and devices using firewalls and access control lists.\n2. Implement strong authentication methods, such as two-factor authentication, for accessing the service.\n3. Use encryption (e.g., SSL/TLS) to protect communication between clients and the PaperCut NG service.\n4. Periodically review user access, configurations, and security settings to ensure compliance with best practices.\n5. Continuously monitor and log activities related to PaperCut NG to detect and respond to potential security threats."
},
{
"issueTypeId": "PhpMyAdmin",
"remediationGuidance": "It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\n\nXpanse recommends securing your database software by taking the following steps:\n\n1. Isolate the database from the public internet by placing it behind a VPN.\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "PiHole",
"remediationGuidance": "Pi-Hole acts as a DNS sinkhole and optionally a DHCP server, and is intended for use only on private networks. This issue identifies all Pi-Hole servers regardless of version. Per CVE-2020-8816, the Pi-Hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease."
},
{
"issueTypeId": "PlexMediaServer",
"remediationGuidance": "To secure Plex Media Server instances, it is recommended to perform the following:\n\n1. Isolate Plex Media Server instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Plex Media Server instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Plex Media Server instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Plex Media Server instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "Pop3Server",
"remediationGuidance": "Some of the most glaring issues with POP3 are its lack of encryption, lack of compatibility with modern authentication systems like MFA and the high risk of critical data loss in case the destination device is compromised or destroyed.\n\nXpanse recommends taking the following steps to secure POP3 instances:\n\n1. Evaluate whether using a limited, insecure protocol like POP3 is absolutely necessary in your organization, or whether IMAP with TLS would be a better alternative.\n2. Should it be necessary to use POP3, it is recommended to enable it to run with implicit TLS encryption over port 995. Another option is using POP3 with explicit TLS over port 110, which allows for traffic to be encrypted if both client and server support STARTTLS.\n3. Place POP3 instances behind a firewall to monitor and control e-mail server traffic.\n4. Do not use third-party e-mail clients that don’t support MFA, as MFA can be easily bypassed when attempting authentication."
},
{
"issueTypeId": "PostgreSQLpgAdminLoginPortal",
"remediationGuidance": "Since web-based admin portals are often misconfigured and vulnerable to exploits that are trivial to run, it is essential to not publicly expose your organization’s PostgreSQL servers to the internet. Secure your PostgreSQL servers by taking the following steps:\n\n1. Put pgAdmin instances behind a firewall and configure it to accept connections only on a small subset of ports.\n2. Prevent brute force password attacks by ensuring the *MAX_LOGIN_ATTEMPTS* verification check is enabled and set to 3 or another low number. You can configure this check in the User Management dialog in the pgAdmin interface or the main configuration file *config.py*. This feature is disabled if the value is set to 0.\n3. Since PostgreSQL does not have strong password complexity checks available, the use of external authentication services is recommended. pgAdmin supports both LDAP and Kerberos and can be integrated with SSO.\n4. Upgrade to the latest version of pgAdmin and install critical security patches. It is particularly important to update pgAdmin to version 6.7&#43; to prevent directory traversal attacks.\n\nFurther documentation: https://www.pgadmin.org/docs/pgadmin4/6.10/index.html"
},
{
"issueTypeId": "PostgreSQLpgwebLoginPortal",
"remediationGuidance": "It is recommended that database login portals are not made accessible to the public internet. In order to securely deploy pgAdmin:\n\n1. Do not transmit unencrypted data to and from the pgAdmin portal. Instead, use an encrypted protocol such as SSL or SSH.\n2. Use a firewall to block all ingress and egress traffic from untrusted sources. If a web and database server are hosted on the same site, only expose the web server to the public internet. You can have traffic to and from the database server managed on a private LAN.\n3. Require all database accounts to have an associated password. Ensure these passwords are complex enough to withstand common dictionary attacks.\n4. Consider using MFA for additional security.\n5. Ensure you are running the latest version of pgAdmin server."
},
{
"issueTypeId": "PostgresServer",
"remediationGuidance": "1. Best practice is to not expose Postgres servers to the internet.\n2. Evaluate if this Postgres Server needs to be exposed to the public internet for business purposes.\n3. If the server does need to be exposed to the public internet or an internal network, it is recommended that the system is configured to listen for and accept connections on the networks that are actually required. Leveraging a layered security approach, including firewalls, encryption, roles, ACLs, and strong authentication practices will help. \n4. If the server does not need to be exposed to the internet, the follow security guidelines set forth by Postgres https://www.postgresql.org/docs/current/runtime.html"
},
{
"issueTypeId": "PptpServer",
"remediationGuidance": "Point-to-Point Tunneling Protocol (PPTP) includes extremely weak authentication and does not establish the integrity of data transported through the PPTP VPN. To minimize the risk of such vulnerabilities, verify the following:\n\n1. Best practice is to replace PPTP servers with modern VPN servers immediately.\n2. If use of PPTP is a business requirement, set Data Encryption to “Maximum strength encryption” and authentication to EAP-TLS or other alternatives to MSChap versions."
},
{
"issueTypeId": "PrimeTekPrimeFaces",
"remediationGuidance": "There are multiple CVEs associated with PrimeTek PrimeFaces, such as CVE-2017-1000486 (a weak encryption flaw leading to remote code execution) and CVE-2020-10544 (a cross-site scripting vulnerability).\nTo secure the server, ensure you are using the latest version of PrimeTek PrimeFaces."
},
{
"issueTypeId": "PrometheusMonitoringFramework",
"remediationGuidance": "If you have identified a vulnerable and exposed instance of Prometheus Monitoring Service, it is important to take immediate action to remediate the vulnerability and protect your system from potential attacks. Here are some steps you can take:\n\n1. Quarantine the machine hosting the Prometheus Monitoring Service to prevent further potential compromise.\n2. Review all available network and host based logs to determine if a compromise took place. If it is determined a compromise took place take all appropriate steps to contain, eradicate, and remediate the incident.\n3. Check if there is a new version of Prometheus Monitoring Service available, and upgrade to the latest version if possible. This may include updating dependencies and plugins as well.\n4. Review security controls and ensure that only the necessary ports are open. Restrict access to the Prometheus Monitoring Service from only trusted sources.\n5. Ensure that the system hosting the Prometheus Monitoring Service is hardened and configured securely. This includes configuring secure passwords, limiting user access, and disabling unnecessary services.\n6. Implement monitoring and alerts to detect any future vulnerabilities or attacks. This may include setting up alerts for unusual activity, configuration changes, or failed login attempts.\n7. Conduct a vulnerability scan of the system to identify any other vulnerabilities that may exist."
},
{
"issueTypeId": "PulseSecurePulseConnectSecureVPN",
"remediationGuidance": "Unpatched and misconfigured Pulse Secure VPN Servers pose a serious security risk to any organization as severe vulnerabilities have been released including remote code execution (RCE) with a total of over 70 CVEs published for this device.\n\n1. Pulse Connect Secure VPN Servers should be patched as soon as possible to prevent active exploits from being successfully ran against these devices.\n2. VPN servers should be configured to include verbose logging to identify activities such as compromised account logins, anomalous geolocation based logins, brute force activity, injection attacks, impossible logins, single IPs hitting multiple accounts, and more.\n3. Ensure administration/backend portals for Pulse Connect Secure VPN are not publicly available.\n4. Ensure your IR plan for reacting to incidents involving your Pulse Connect Secure VPN include the ability to terminate sessions for users and deploy countermeasures in a swift timely manner.\n5. Based on your organization and the nature of it&#39;s business consider geolocation IP filtering for access to the user login interface.\n6. Consider blocking known TOR exit node traffic.\n7. If possible obfuscate the nature of the server/domain hosting Pulse Connect Secure VPNs by sanitizing applicable DNS records, server responses, and the domain name.\n8. Pulse Secure VPN Best Practices https://docs.pulsesecure.net/WebHelp/PDC/Migration%20Guides/NC_to_PDC/Content/Links_Network_Connect_to_Pulse_Desktop_Client_Migration_Guide/Considering_Best_Practices.htm"
},
{
"issueTypeId": "QNAPNAS",
"remediationGuidance": "To secure QNAP NAS instances, it is recommended to perform the following:\n\n1. Isolate QNAP NAS instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all QNAP NAS instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that QNAP NAS instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on QNAP NAS instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "QuestKaceSystemManagementAppliance",
"remediationGuidance": "If it is determined that this asset should not be publicly accessible from the internet, identify the asset owner and work with them to restrict access.\nIf the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF)."
},
{
"issueTypeId": "RabbitMQ",
"remediationGuidance": "Due to RabbitMQ acting as a single location for applications to communicate, it can potentially contain sensitive information.\nIt is recommended to enable TLS support as well as working to implement various access control and authentication features in RabbitMQ.\nMore information regarding configuration of Rabbit MQ can be found on the vendor site https://www.rabbitmq.com/admin-guide.html."
},
{
"issueTypeId": "RdpServer",
"remediationGuidance": "Recommendations to reduce the likelihood of malicious RDP attempts are as follows:\n\n1. Best practice is to not have RDP publicly accessible on the Internet and instead only on trusted local networks.\n2. Implement a risk-based approach that prioritizes patching RDP vulnerabilities that have known weaponized public exploits.\n3. Limit RDP access to a specific user group and implementing lockout policies is an additional measure to protect against RDP brute-forcing which is another common tactic used by attackers. In addition, enable NLA (Network Level Authentication) which is non-default on older versions.\n4. If remote access to RDP or terminal services is a business requirement, it should only be made accessible through a secure Virtual Private Network (VPN) connection with multi-factor authentication (MFA) to the corporate network or through a zero-trust remote access gateway."
},
{
"issueTypeId": "RedisEnterpriseLoginPortal",
"remediationGuidance": "Redis is designed to be accessed by trusted clients inside trusted environments. Basic steps to harden Redis insances include:\n\n1. Redis Enterprise should be deployed on a trust network and not accessible to the public Internet.\n2. Anti-virus exclusions should be implemented to ensure anti-virus and security solutions do not interfere with Redis Enterprise in order to maintain availability.\n3. Send logs to a remote logging server.\n4. Configure nodes to reboot in a sequence rather than all at once.\n5. Implement client-side encryption if encryption in memory is required.\n6. Implement role-based access for users.\n7. Prevent database uses from logging into the admin console.\n8. Disable the default user.\n9. Enable client certificate authentication.\n10. Leverage LDAP authentication if LDAP is used within the organization.\n\nAdditional recommendations:\nhttps://docs.redis.com/latest/rs/security/"
},
{
"issueTypeId": "RedisServer",
"remediationGuidance": "Although Redis is not inherently vulnerable, its default configurations have weak authentication, encryption, or access control options and can open up your organization to breaches. For example, a common attack vector for Redis data stores is abusing these weak default configurations to perform unauthorized crypto mining on Redis instances.\n\nXpanse recommends taking swift action to harden your organization’s Redis instances:\n\n1. Since Redis is by default bound to network interfaces and is often misconfigured or unsecured, it is recommended that Redis should only ever be available to trusted clients on your network. Therefore, a good first measure is to restrict access to the Redis port so that it is only accessible by the web application server.\n2. Redis does not enforce authentication by default, so enabling authentication and enforcing robust password policies and ACLs is imperative.\n3. Enable TLS so that all communications are encrypted\n4. Rename critical commands, such as &#96;FLUSHDB&#96; and &#96;FLUSHALL&#96; , so that attackers cannot perform nuclear operations on the database if breached.\n5. It is advisable to use the Redis Enterprise Cloud product instead of the open-source version, as the Cloud edition has more secure configuration options.\n\nPlease review the https://redis.io/docs/management/security/ for more information on securing Redis."
},
{
"issueTypeId": "RejettoHttpFileServer",
"remediationGuidance": "To secure Rejetto instances, it is recommended to perform the following:\n\n1. Isolate Rejetto instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Rejetto instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Rejetto instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Rejetto instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "RockwellAutomationCompactLogix5370SeriesPLCController",
"remediationGuidance": "The exploitation of ICS devices like Rockwell Automation’s CompactLogix 5370 Series PLC could lead to malicious actors interfering with critical infrastructure or high-stakes automation processes. Therefore, it is recommended that CompactLogix 5370 Series PLCs are not publicly exposed to the internet.\n\nThe following remediation guidance is recommended for securing Rockwell Automation CompactLogix 5370 Series PLC:\n\n1. Minimize network exposure by deploying the CompactLogix 5370 Series PLC behind a firewall and ensure it is not directly accessible from the Internet. Block unauthorized traffic and regularly monitor network traffic to detect any suspicious activity.\n2. If remote access is required, limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system.\n3. Implement strong authentication measures to prevent unauthorized access, such as multi-factor authentication and strong password policies.\n4. Keep the PLC&#39;s hardware and software up to date by regularly applying patches and updates to address known vulnerabilities.\n5. Reduce the attack surface of the system by disabling any unused services on the PLC.\n6. For additional guidance, Xpanse recommends following https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf."
},
{
"issueTypeId": "RockwellAutomationMicroLogix1400SeriesPLCController",
"remediationGuidance": "Given the importance of PLCs in managing and operating industrial control systems, these devices should not be accessible from the public Internet. If peered, local connections are insufficient, remote management should be strictly controlled to ensure only authenticated users can access these devices. Xpanse recommends securing PLCs by taking the following steps:\n\n1. Change the default credentials: Rockwell MicroLogix PLCs can be accessed remotely if the default HTTP credentials are not changed.\n2. Place networked PLC systems behind a firewall and implement logical separation to isolate the device from other critical systems.\n3. Expeditiously update PLC software and firmware to use the latest patches.\n4. Implement strict access control policies that follow the principle of least privilege. This means that all users should have access only to the essential components that allow them to do their jobs.\n5. Regularly monitor network activity and user engagement and set up robust alerting.\n6. Review logs to determine if any compromise took place prior to the discovery of the exposed device."
},
{
"issueTypeId": "RoundcubeWebmail",
"remediationGuidance": "If an attacker gains access to an exposed Roundcube Webmail server, they could potentially compromise the entire email system, affecting multiple users and accounts. This could lead to unauthorized access to sensitive information, personal data, and contacts of all users on the server.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Regularly update the Roundcube Webmail software, plugins, and underlying server software to ensure that all known vulnerabilities are patched.\n2. Implement strong authentication mechanisms such as multi-factor authentication (MFA) and enforce the use of strong, unique passwords for all user accounts.\n3. Configure firewalls and access control lists (ACLs) to restrict incoming and outgoing traffic to the Roundcube Webmail server, allowing only necessary and trusted connections.\n4. Enable encryption (e.g., SSL/TLS) for both data in transit and at rest to protect sensitive information from unauthorized access and tampering.\n5. Perform regular security audits, vulnerability assessments, and monitor server logs to detect and respond to potential threats, unauthorized access, or suspicious activity in a timely manner."
},
{
"issueTypeId": "RpcBindServer",
"remediationGuidance": "By default, rpcbind servers have weak authentication mechanisms and have the ability to assign a wide range of ports for the services it controls.\n1. Use a blocklist to ensure only trusted sources can communicate with rpcbind servers.\n2. Avoid using hostnames when specifying procedure destinations, as they can be spoofed using techniques such as DNS poisoning. Instead, only use IP addresses.\n3. For additional security recommendations, visit https://www.rfc-editor.org/rfc/rfc5531.html#section-14."
},
{
"issueTypeId": "RsyncServer",
"remediationGuidance": "Rsync servers should not be exposed to the internet as they may contain sensitive information especially since data exposure has become a prominent business risk to organizations.\n\n1. Identify the exposed Rsync server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Rsync should be configured with hosts allow and hosts deny directives in order to follow least privilege principles.\n3. Rysnc should then be setup to use the auth users directive which narrows the attack surface by user.\n4. SSH should be leveraged for all Rysnc communication to allow for encryption."
},
{
"issueTypeId": "RtspServer",
"remediationGuidance": "Real Time Streaming Protocol (RTSP) should never be exposed to the internet as most RTSP servers are embedded systems that contain numerous vulnerabilities, many of which cannot be patched.\nIt is recommended to identify the device with the RTSP server and configure the device to not be directly accessible from the internet."
},
{
"issueTypeId": "RubyOnRails",
"remediationGuidance": "The security requirements of a Ruby on Rails web applications will vary drastically depending on the implementation. General recommendations include determining if the instance should be publicly accessible, implementing a WAF, and running the latest secure version.\n\nFor Ruby on Rails specific security considerations, visit the https://guides.rubyonrails.org/security.html."
},
{
"issueTypeId": "RuckusWirelessAdmin",
"remediationGuidance": "If you have an exposed instance of Ruckus Wireless Admin, it is important to take immediate action to remediate the situation to prevent unauthorized access and potential security breaches. Here are some steps you can take to remediate an exposed instance of Ruckus Wireless Admin:\n\n1. Determine how the instance was exposed in the first place. This could be due to a misconfigured firewall, an open port, or an unsecured wireless network.\n2. Once you have identified the cause of the exposure, take steps to secure the instance. This may include updating firewall rules, closing open ports, and securing the wireless network.\n3. Change the passwords for all user accounts associated with the instance, including the admin account. Make sure to use strong passwords that include a mix of letters, numbers, and special characters.\n4. Make sure that the Ruckus Wireless Admin software is up-to-date and that all security patches have been installed.\n5. Monitor the network for any suspicious activity that may indicate a security breach and take appropriate action if necessary."
},
{
"issueTypeId": "S7CommServer",
"remediationGuidance": "The standard S7 communication protocol does not use secure communication methods and can be susceptible to session hijacking, denial of service (DoS) attacks, spoofing, and other attacks.\n\nA best practice is to make these types of devices accessible to trusted networks only. It is recommended that users protect network access with appropriate mechanisms such as firewalls, segmentation, VPN, etc. In addition to that, organizations should password-protect S7 comms and disallow client connections.\n\nPlease follow vendor guidance to configure the operational environment as described in https://www.siemens.com/cert/operational-guidelines-industrial-security."
},
{
"issueTypeId": "SapCLM",
"remediationGuidance": "It is generally not recommended to expose SAP Contract Lifecycle Management (CLM) to the public internet. SAP CLM is a business-critical application that contains sensitive information such as contract terms, pricing, and other confidential data. Exposing it to the public internet increases the risk of unauthorized access, hacking, and other security threats. Additionally, the product is impacted by CVE-2022-41273, an open redirect vulnerability.\n\nIf you need to access SAP CLM from outside your organization&#39;s network, it is recommended to use a VPN (Virtual Private Network) or other secure remote access solutions. This way, you can ensure that the application is only accessible to authorized users and that all communications are encrypted and secure."
},
{
"issueTypeId": "SAPEmployeeSelfService",
"remediationGuidance": "Compromise of SAP Employee Self-Service could lead to an attacker obtaining information about employees and users.\n1. Evaluate whether this asset should be accessible from the public internet.\n2. If the asset needs to be accessible from the internet for a business purpose, it is recommended to place the device behind a security tool such as a Web Application Firewall (WAF) with proper logging and alerting in place.\n3. More information regarding secure settings and configurations can be found at SAP&#39;s documentation https://help.sap.com/docs/HR_RENEWAL_SPV/c05a655202604791bd0d4ab28061f934/19567493c47548ebab752643d9b5a139.html"
},
{
"issueTypeId": "SapNetWeaverApplicationServer",
"remediationGuidance": "SAP NetWeaver Application Servers if not secured properly can pose a serious security risk to any organization as severe vulnerabilities have been \nreleased including CVE-2020-6287 allowing for unauthenticated access.\n\n1. Identify the exposed SAP NetWeaver Application Servers and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks posed by these trust relationships.\n3. Ensure that SAP NetWeaver Application Servers are configured to use TLS and Role Based Access Controls (RBAC). If for some reason the SAP NetWeaver Application Servers must be exposed to the internet leverage MFA and place the server behind a Web Application Firewall (WAF).\n4. Follow SAP best practices and ensure all SAP NetWeaver systems are fully patched. SAP provides guidance https://help.sap.com/docs/SAP_NETWEAVER/9e41ead9f54e44c1ae1a1094b0f80712/576f5c1808de4d1abecbd6e503c9ba42.html?language&#61;en-US."
},
{
"issueTypeId": "SAPSolutionManager",
"remediationGuidance": "SAP Solution Manager (SolMan) provides a significant amount of control over an organization’s infrastructure and offers complex access control options that may be difficult to keep track of, which makes it frequently vulnerable to attacks involving authentication bypass attempts. Should such an attack succeed, an attacker could gain critical information about your organization’s SAP suite and use that knowledge to stage larger-scale or more complex attacks.\n\nXpanse recommends taking the following steps to secure your SolMan instances:\n\n1. Ensure that SolMan is not exposed to the public internet. All instances of Solution Manager should be placed behind a VPN or firewall.\n2. If Solution Manager is integrated with third-party solutions, it’s critical to keep track of vulnerabilities associated with these products and patch these dependencies promptly.\n3. Enable logging and tracing using SAP Netweaver Administrator and use this information to track and validate user creation on SolMan. Tracking new users is important because attackers have been known to gain sufficient access to create users with escalated privileges, allowing them to move through SAP SolMan undetected."
},
{
"issueTypeId": "SAPSuccessFactors",
"remediationGuidance": "Compromise of SAP SuccessFactors can lead to sensitive data being exfiltrated from your organization.\n\n1. Detailed information regarding integration best practices and considerations for SAP SuccessFactors can be found https://blogs.sap.com/2022/04/15/sap-successfactors-employee-data-integration-best-practices-and-considerations/.\n2. Another option is to look into a Cloud Access Security Broker (CASB) solution to monitor all connections to SAP SuccessFactors and enforce necessary security policies."
},
{
"issueTypeId": "SchneiderElectricAltivarVariableSpeedDrive",
"remediationGuidance": "Schneider Electric Altivar Variable Speed Drive (VSD) devices could be vulnerable to malicious attacks, such as denial of service or unauthorized access, so they should not be exposed to the public internet. Xpanse recommends placing these devices behind a firewall or VPN and regularly applying firmware and security patches."
},
{
"issueTypeId": "SchneiderElectricAPCWebSNMPManagementSmartSlotCard",
"remediationGuidance": "The Schneider Electric APC Web SNMP Management SmartSlot Card should not be accessible from the internet because it is used to manage power infrastructure. Exposure to the Internet invites unauthorized access and exploitation attempts from malicious actors. Best practices include ensuring the APC Web SNMP Management Card is behind a firewall and configured to accept SNMP connections only from authorized IP addresses or networks."
},
{
"issueTypeId": "SchneiderElectricEcoStruxurePowerMonitoringExpert",
"remediationGuidance": "The Power Monitoring Expert Web UI should not be exposed to the Internet, as it displays sensitive information regarding the status and operations of power systems. Role-based access controls should restrict access to only authorized users and, when necessary, remote access should only be possible via a VPN."
},
{
"issueTypeId": "SchneiderElectricHarmonyGTOSeriesHMI",
"remediationGuidance": "Schneider Electric Harmony GTO Series HMI systems should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Harmony GTO Series HMI systems entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricHarmonyGTUSeriesHMI",
"remediationGuidance": "Schneider Electric Harmony GTU Series HMI systems should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Harmony GTU Series HMI systems entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricHarmonySTUAndSTOSeriesHMI",
"remediationGuidance": "Schneider Electric Harmony STU &amp; STO Series HMI systems should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Harmony STU &amp; STO Series HMI systems entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricMagelisXBTTouchscreenHMI",
"remediationGuidance": "Schneider Electric Magelis XBT Touchscreen HMI should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing the Magelis XBT Touchscreen HMI entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricModicon340SeriesPLC",
"remediationGuidance": "Schneider Electric Modicon M340 Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Modicon M340 Series entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricModiconEthernetWebModule",
"remediationGuidance": "If an exposed Schneider Electric Modicon Ethernet Web Module is compromised, it can lead to unauthorized access and control of industrial automation systems, data theft, malware infections, DDoS attacks, and reputation damage.\n\nIt is recommended to perform the following:\n1. Disable the default login credentials and change them to strong, unique passwords to prevent unauthorized access.\n2. Ensure that the module&#39;s firmware is up to date with the latest security patches and updates to address any known vulnerabilities.\n3. Implement access control measures to restrict access to the module to only authorized personnel, such as IP whitelisting, VPNs, and two-factor authentication.\n4. Configure the module to use secure communication protocols such as HTTPS and SSL/TLS to encrypt network traffic and prevent eavesdropping and tampering.\n5. Regularly monitor the module&#39;s network traffic for any suspicious activity that may indicate a potential security breach."
},
{
"issueTypeId": "SchneiderElectricModiconM200SeriesPLC",
"remediationGuidance": "Schneider Electric Modicon M200 Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Modicon M200 Series entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricModiconM580SeriesPLC",
"remediationGuidance": "Schneider Electric Modicon M580 Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Modicon M580 entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricModiconMC80PLC",
"remediationGuidance": "The exploitation of Schneider Electric Modicon MC80 PLCs could lead to malicious actors interfering with critical operations involved in the management of Concentrated Solar Power (CSP) plants.\n\nIt is strongly recommended to implement robust access control policies and ensure Schneider Electric Modicon MC80 PLCs are protected by a firewall or VPN. Additionally, the system should receive regular patches and updates, and inbound and outbound traffic should be closely monitored."
},
{
"issueTypeId": "SchneiderElectricModiconMomentumSeriesPLC",
"remediationGuidance": "The exploitation of ICS devices, such as a Schneider Electric Modicon Momentum PLC, could lead to malicious actors interfering with critical infrastructure or high-stakes automation processes.\n\nIt is strongly recommended to implement robust access control policies and ensure Modicon Momentum PLCs are protected by a firewall or VPN. Additionally, the system should receive regular patches and updates, and inbound and outbound traffic should be closely monitored."
},
{
"issueTypeId": "SchneiderElectricModiconQuantumSeriesPLC",
"remediationGuidance": "Schneider Electric Modicon Quantum PLCs are not meant to be exposed to the public internet, as exploitation could significantly impact critical infrastructure. It is strongly recommended to implement robust access control policies and ensure Schneider Electric Modicon Quantum PLCs are protected by a firewall or VPN. Additionally, these devices should receive regular firmware patches and updates, and inbound and outbound traffic should be closely monitored."
},
{
"issueTypeId": "SchneiderElectricPowerChute",
"remediationGuidance": "Schneider Electric Power Chute Business Edition enables remote management of power infrastructure and therefore should not be accessible from the public internet. Exposure to the internet invites unauthorized access and exploitation attempts from malicious actors. Best practices include ensuring that the Power Chute Business Edition management console and server are behind a firewall and using strong access controls to restrict user access."
},
{
"issueTypeId": "SchneiderElectricPowerlinkLightingControlSystem",
"remediationGuidance": "Schneider Electric Powerlink Series Lighting Control System should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing the Powerlink Series Lighting Control System entails the following steps:\n\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\n2. Implement authentication protocols to ensure that only authorized users can access the system.\n3. Regularly update the system with the latest security patches and software updates.\n4. Disable any unnecessary services and protocols not required for the system to function.\n5. Implement network segmentation to isolate the system from other networks.\n6. Disable unused services: Any unused services should be disabled to reduce the attack surface of the system.\n7. Monitor the system for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricPowerLogicSeriesPowerMeter",
"remediationGuidance": "Schneider Electric PowerLogic Series Power Meter should not be publicly exposed to the internet. Compromise of the PowerLogic Series Power Meter can impact system availability and loss of sensitive data. Securing Power Meter entails controlling access through a firewall and applying security patches regularly. Additionally, multifactor authentication and strong passwords should be used to protect Power Meter from unauthorized access. Related access logs should also be monitored for any suspicious activity."
},
{
"issueTypeId": "SchneiderElectricTwidoSeriesPLC",
"remediationGuidance": "The Schneider Electric Twido Series PLC should not be accessible from the internet because it is commonly used to manage physical control system functionality. Exposure to the Internet invites unauthorized access and exploitation attempts from malicious actors. Best practices include ensuring the Twido Series PLC is behind a firewall and configured to accept connections only from authorized IP addresses or networks.\n\n Note: Twido Series PLCs are no longer supported and if these devices reside in your network it is advised by Schneider Electric to upgrade to a Modicon M221 PLC"
},
{
"issueTypeId": "SchneiderElectricZelioSeriesPLC",
"remediationGuidance": "Schneider Electric Zelio Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Zelio entails the following steps:\n\n1. Ensure access to the Zelio Series PLC is restricted by a firewall to limit access to the system from the internet.\n2. Install a firewall on the Zelio Series PLC to restrict access to the system from the internet and also limit outbound traffic.\n3. Change the default password of the Zelio Series PLC to a strong and unique password that is not easily guessed.\n4. Disable any unnecessary services or ports on the Zelio Series PLC.\n5. Ensure that the Zelio Series PLC is running the latest version of its firmware and that all security patches are applied.\n6. Utilize network segmentation to limit access to the Zelio Series PLC from other systems on the network.\n7. Monitor the Zelio Series PLC for any suspicious activity or unauthorized access attempts.\n8. Utilize secure protocols such as SSH or SFTP for remote access to the Zelio Series PLC.\n9. Regularly audit the Zelio Series PLC to ensure its security settings are correctly configured."
},
{
"issueTypeId": "Section889Violation",
"remediationGuidance": "Investigate the devices that have been flagged under this policy and work with the owner of the affected assets to remove them from your network.\nFor clarification, Section 889 of the 2019 NDAA prohibits executive agencies from using equipment or services that have been flagged under this policy. (Huawei, Hikvision, Hytera, Dahua, ZTE)"
},
{
"issueTypeId": "SelfSignedCertificate",
"remediationGuidance": "1. Devices directly accessible from the internet should not be utilizing self-signed certificates. Since these certificates lack signing by a certificate authority (CA) they cannot be revoked or verified easily.\n2. Identify the device with the self-signed certificate and identify if it should be accessible to the internet.\n3. To replace a self-signed certificate with one from a certificate authority it is best practice to follow guidelines from the manufacturer, vendor, or internal documentation as this process can vary widely."
},
{
"issueTypeId": "ServiceInAdversaryCountry",
"remediationGuidance": "Using services in adversary countries will often allow such governments to access any information stored or sent through such devices and services. If such services are found, locate possible infrastructure located in such areas. These can be previously owned and since relocated systems or devices still included in the network. If found remove such infrastructure."
},
{
"issueTypeId": "SharepointServer",
"remediationGuidance": "SharePoint servers are particularly vulnerable to remote code execution attacks, so hardening them to employ the latest best security practices is essential.\n\nXpanse recommends securing your organization’s SharePoint servers by taking the following action:\n\n1. Implement a Zero-Trust architecture by enabling multi-factor authentication (MFA), limiting external site sharing to only trusted domains, creating IP allow lists, and using conditional access policies to curate user access.\n2. Install Cumulative Updates monthly and deploy security hotfixes as soon as possible after release.\n3. Verify that encryption is enabled both in transit and at rest.\n\nFor more detailed guidelines, please review https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/security-for-sharepoint-server and https://learn.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort."
},
{
"issueTypeId": "ShortKeyCertificate",
"remediationGuidance": "The National Institute of Standards and Technology (NIST) currently recommends that RSA certificate keys use 2048-bit or greater key sizes. CA and OCSP Responder signing RSA keys should have 2048 or 3072 bits. Having smaller keys could allow attackers to crack the certificate before the certificate expires. Additional information may be found in the https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf. Table 2-1 highlights the recommended algorithms and key sizes."
},
{
"issueTypeId": "SiemensDesigo",
"remediationGuidance": "The compromise of a Siemens Desigo instance could lead to unauthorized access to building systems, loss of sensitive data, and disruption of critical building functions. Below are some remediation steps that organizations can take to secure their Siemens Desigo installations:\n\n1. Minimize network exposure by deploying Desigo behind a firewall and ensure it is not accessible from the Internet. Block unauthorized traffic and regularly monitor network traffic.\n2. When remote access is required, further limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system and that access is granted on a need-to-know basis.\n3. Implement multi-factor authentication to prevent unauthorized access and enforce password policies.\n4. Keep Desigo hardware and software up to date by regularly applying patches and updates in order to address known vulnerabilities.\n5. Disable unused services in order to limit the attack surface of the platform.\n\nFor additional guidance, Xpanse recommends following https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf."
},
{
"issueTypeId": "SiemensPolarionApplicationLifecycleManagement",
"remediationGuidance": "Exploitation of Siemens Polarion could lead to loss of intellectual property, malicious interference with applications managed by Polarion, or could provide an attacker with sufficient information about your organization’s applications to stage more significant, complex attacks.\n\nBelow are some remediation steps that organizations can take to secure publicly exposed Siemens Polarion instances:\n\n1. Deploy Polarion behind a firewall in order to prevent unauthorized access and regularly monitor network traffic.\n2. Limit access to the application by configuring access control lists (ACLs) and implementing access through a VPN.\n3. Implement multi-factor authentication to prevent unauthorized access.\n4. Keep Polarion up-to-date by regularly applying software patches and updates in order to address known vulnerabilities.\n\nFor additional guidance, Xpanse recommends following Siemens’ https://www.siemens.com/cert/operational-guidelines-industrial-security and the https://polarion.plm.automation.siemens.com/hubfs/Docs/Guides_and_Manuals/Polarion_Enterprise_Setup_Guide-2.pdf."
},
{
"issueTypeId": "SiemensSimatic",
"remediationGuidance": "If an attacker compromises a Siemens SIMATIC device, they could potentially gain control of the entire industrial process that the device is a part of. This could lead to disruptions in production, damage to equipment, and even harm to personnel.\n\nXpanse recommends following these general ICS/SCADA best practices when securing Siemens SIMATIC devices:\n\n1. Place remotely accessible devices behind a firewall and ensure they are logically separated from other critical systems, where possible.\n2. Ensure all applicable software and firmware are updated to use the latest versions and patches.\n3. Implement strict access control policies that follow the principle of least privilege, meaning that all users should have access only to the essential components that allow them to do their jobs.\n4. Regularly monitor network activity and user engagement and set up robust alerting."
},
{
"issueTypeId": "SipServer",
"remediationGuidance": "SIP servers are common attack vectors for cyber criminals. To maintain a secure SIP server, a number of security measures should be implemented.\n1. Assess whether the SIP server must be accessible on the public facing internet. If the server must be publicly accessible, require the use of a secure VPN.\n2. Limit access to the SIP server to trusted sources by implementing an IP Access Control List.\n3. Enable digest authentication. This will require users to authenticate with a username and password. Ensure chosen passwords are strong and that lockout policies are used.\n4. Use TLS to ensure that information being sent to and from the server is encrypted."
},
{
"issueTypeId": "SitecorePlatform",
"remediationGuidance": "If an attacker gains access to an exposed Sitecore Platform server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization’s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Isolate the Sitecore Platform server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\n2. Regularly update the Sitecore Platform software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\n5. Monitor the Sitecore Platform server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices."
},
{
"issueTypeId": "SLP",
"remediationGuidance": "Allowing SLP traffic to traverse your network&#39;s external boundary poses a serious security risk. Publicly exposing SLP could allow an attacker to obtain information about services running on your LAN and potentially run exploits against the service.\n\nAdditionally, it is worth mentioning that this service is sometimes bundled into software as a part of tool&#39;s service discovery functionality which can have detrimental security impacts should the service be available beyond your LAN. An example of this would be the ransomware attacks against VMware ESXi in February of 2023.\n\nThe following steps are recommended if this issue presents in your network:\n1. Close port 427 and do not allow traffic on this port to leave your environment. \n2. Review logs to determine if any suspicious activity can be identified from traffic outbound on this port (e.g., suspicious external IPs connecting to SLP, large amounts of egress traffic, anomalous packet data, etc.)\n3. Develop policies and procedures to prevent future exposures of this service or other risky services."
},
{
"issueTypeId": "SmbServer",
"remediationGuidance": "Due to the large number of cyber-attacks targeting SMB, Xpanse recommends that organizations implement the following best practices:\n\n**1. Update to the most recent SMB version** to reduce the attack surface area and apply patches promptly. It’s imperative to disable SMBv1 whenever possible, as it does not support encryption and has significant security vulnerabilities. If an organization cannot immediately transition off SMBv1, it is recommended that systems using this protocol should not be publicly accessible and should have strict access control policies.\n**2. Secure the network perimeter** by blocking connections to all versions of SMB for TCP ports 445 and 139 and UDP ports 137 and 138.\n**3. Enable encryption for SMB.** SMB v3.0 and up offer end-to-end encryption; however, this is not enabled by default. To enable SMB encryption, review the procedures listed in Microsoft’s SMB security recommendations: https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-security\n**4. Harden SMB authentication** by requiring unique and complex passwords\n**5. Restrict SMB traffic** between internal assets to prevent the exploitation of “hidden” shares.\n\nFurther documentation: https://www.cisa.gov/uscert/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices"
},
{
"issueTypeId": "SmtpServer",
"remediationGuidance": "Vulnerabilities in the Simple Mail Transfer Protocol (SMTP) can range from data leaks to Remote Code Execution (RCE).\n1. Best practice is to have a layered SMTP solution, turn off mail relay, and enforce access via an allow-list and/or some form of authentication (SPF, DKIM, DMARC).\n2. Another approach to take is to configure the SMTP server to communicate solely via SSL.\n3. It is also recommended to look into security hardening documentation for the specific vendor/SMTP server you are implementing and create a checklist of things to configure."
},
{
"issueTypeId": "SnmpServer",
"remediationGuidance": "Simple Network Management Protocol (SNMP) is commonly abused to gain unauthorized access to network devices and as such should not be responding to requests from the public internet.\n\n1. Update to the most recent SNMPv3 version to reduce the attack surface area and apply patches promptly. It’s imperative to disable SNMPv1 and SNMPv2 whenever possible, as it does not support encryption and has significant security vulnerabilities. \n2. Secure the network by blocking outbound SNMP responses on UDP ports 161 and 162.\n3. It is recommended to combine SNMPv3 with management information base (MIB) allow-listing using SNMP views.\n4. SNMP security best practices from CISA can be followed https://www.cisa.gov/uscert/ncas/alerts/TA17-156A"
},
{
"issueTypeId": "SolarViewCompact",
"remediationGuidance": "SolarView Compact is susceptible to several security vulnerabilities, including CVE-2022-29303, a command injection vulnerability included in CISA&#39;s BOD 22-01.\n\nIf attackers gain access to a SolarView Compact device, they could access and manipulate the solar power generation data, leading to inaccurate reporting and monitoring. Additionally, they may intentionally tamper with the device’s settings or functionality, causing disruptions in solar power generation, measurement, and overall system performance.\n\nTo keep SolarView Compact devices secure, Xpanse recommends performing the following:\n\n1. Implement proper access controls such as strong authentication, unique usernames and passwords, and user access restrictions.\n2. Ensure the SolarView Compact device is running the latest firmware to address any known security vulnerabilities.\n3. Place the device in a separate network segment, isolating it from critical systems and reducing the risk of lateral movement in case of a breach.\n4. Continuously monitor the device for suspicious activity and set up alerts for potential security events.\n5. Periodically review SolarView Compact’s security guidelines and apply recommended best practices to maintain a secure environment."
},
{
"issueTypeId": "SolarWindsOrionPlatform",
"remediationGuidance": "The SolarWinds breach was a multi-part, sophisticated attack that involved the distribution of the SUNBURST backdoor. SUNBURST is a digitally signed malware that was embedded into a SolarWinds plugin, allowing attackers to move laterally within an organization’s network when the backdoor is executed. The impacted versions are 2019.4 HF 5,2020.2 with no patch installed or 2020.2 HF 1. If any of those versions are running, upgrading to 2020.2.1 HF 2 or above is imperative.\n\nSince SUNBURST is digitally signed and looks legitimate, assessing the impact of this intrusion could be complex. Follow CISA’s recommended process for remediating malicious activity caused by SUNBURST. Your organization can also investigate potential SUNBURST activity using the https://unit42.paloaltonetworks.com/atoms/solarstorm/\n\nFurther documentation: https://www.cisa.gov/uscert/ncas/current-activity/2021/03/09/guidance-remediating-networks-affected-solarwinds-and-active"
},
{
"issueTypeId": "SonatypeNexusRepositoryManager",
"remediationGuidance": "Xpanse recommends following the vendor&#39;s https://help.sonatype.com/repomanager3/planning-your-implementation for properly configuring Nexus instances. It is strongly recommended that Nexus instances are only accessible through a reverse proxy."
},
{
"issueTypeId": "SonicWallEmailSecurity",
"remediationGuidance": "To secure SonicWall Email Security instances, it is recommended to perform the following:\n\n1. Isolate SonicWall Email Security instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all SonicWall Email Security instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that SonicWall Email Security instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on SonicWall Email Security instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "SonicWallSecureMobileAccessVpn",
"remediationGuidance": "SonicWall Secure Mobile Access VPN is a frequent target of sophisticated attacks by malicious actors, and therefore, its access to the public internet should be as restricted as possible. To secure your instances of SMA, Xpanse recommends implementing a Zero-Trust architecture and staying up-to-date on the latest patches:\n\n1. Configure the Network Tunnel Service to manage access to the appliance. Using the network tunnel service with configured IP address pools is a security best practice for VPNs because it gives organizations visibility into traffic for their remote users. This configuration helps with proactively detecting intruders and containing attacks for remote users. Please note that split tunneling is not recommended as it may lead to critical data being intercepted by malicious actors. Xpanse instead recommends using the Redirect All configuration mode.\n2. Set up Zones of Trust to secure traffic from the configured network tunnel and assign user groups, realms, and communities to the appropriate zones to reduce your organization’s attack surface.\n3. Closely monitor traffic logs by looking at the egress traffic captured in appliance logs. Should logs be redirected to syslog, ensure that no critical data is transmitted as syslog communications are not encrypted.\n4. Enable 2FA for all users. This product can be integrated with RSA *SecurID* Access using RADIUS.\n5. Employ End Point Control components to verify that a user’s environment is secure and to protect sensitive data.\n\nMore information can be found in the https://www.sonicwall.com/support/technical-documentation/docs/sma_100-10-2-administration_guide/Content/sma-app-best-practices.htm/."
},
{
"issueTypeId": "SonicWallSecureRemoteAccess",
"remediationGuidance": "SonicWall Secure Remote Access (SRA) is no longer supported by the vendor. This means the application does not recieve security updates/patches and is likely to contain security vulnerabilities. Removing deprecated and unsupported applications reduces the attack surface, and is recommended as a best practice for Internet facing targets."
},
{
"issueTypeId": "SonicWallSonicOS",
"remediationGuidance": "Determine whether this asset should be exposed to the public internet or not.\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible."
},
{
"issueTypeId": "SophosSGSeriesFirewall",
"remediationGuidance": "Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\n\nXpanse recommends performing the following steps to keep firewall devices secure:\n\n1. Ensure the firewall’s administration panel is not publicly exposed to the internet.\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts."
},
{
"issueTypeId": "SophosXGSeriesFirewall",
"remediationGuidance": "Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\n\nXpanse recommends performing the following steps to keep firewall devices secure:\n\n1. Ensure the firewall’s administration panel is not publicly exposed to the internet.\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts."
},
{
"issueTypeId": "SpinnakerWebServer",
"remediationGuidance": "Spinnaker is a continuous-delivery platform for managing and releasing software that has known vulnerabilities that when exploited could provide access to internal infrastructure.\n1. Identify all instances of Spinnaker Web Server and leverage a layered security approach including firewalls, encryption, roles, ACLs, and strong authentication practices.\n2. Security best practices can be followed from Spinnaker https://spinnaker.io/docs/setup/other_config/security/"
},
{
"issueTypeId": "SslTlsCbcCipher",
"remediationGuidance": "1. The Cipher Block Chaining (CBC) cipher suite found in older versions of SSL and TLS is vulnerable to numerous security vulnerabilities including the BEAST and POODLE attacks.\n2. Determine which version of SSL and or TLS is being used in the environment and the CBC cipher suite. Where possible upgrade to a more secure version of TLS that allows for the Authenticated Encryption with Additional Data (AEAD) cipher suite.\n3. If disabling SSLv3 is not tenable, then it is strongly encouraged to use the TLS_FALLBACK_SCSV signal. This protocol extension must be supported both client-side and server-side to be fully functional. More information can be found at: https://www.kb.cert.org/vuls/id/577193"
},
{
"issueTypeId": "SugarCRM",
"remediationGuidance": "There are a number of security flaws associated with specific versions of SugarCRM. For example, CVE-2023-22952 could lead to remote code execution for SugarCRM versions 11.0.0 through 11.0.4. To ensure your organization remains secure:\n\n* Determine if this specific instance of SugarCRM must be accessible on the internet. If not, work with the asset owner to remove public access.\n* Upgrade to the latest secure version of SugarCRM. Details on supported and EOL versions can be found on the https://support.sugarcrm.com/Resources/Supported_Versions/.\n* Consider using a web application firewall (WAF) to protect against attacks and to limit access to approved devices."
},
{
"issueTypeId": "SumavisionRouterEnhancedMultimediaRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "SymantecEndpointProtectionManager",
"remediationGuidance": "Symantec Endpoint Protection Manager is a system to manage Symantec Endpoint Protection clients from a web console.\n* It is recommended to determine whether this interface should be exposed to the public Internet.\n* If the application needs to be exposed to the public internet, it is recommended to require two-factor authentication for all users.\n* More information regarding configuration and best practices can be found in the official documentation https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Related-Documents.html under &#34;Installation and Administration Guide&#34; for the version being used."
},
{
"issueTypeId": "SymantecMessagingGateway",
"remediationGuidance": "To secure Symantec Messaging Gateway instances, it is recommended to perform the following:\n\n1. Isolate Symantec Messaging Gateway instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Symantec Messaging Gateway instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Symantec Messaging Gateway instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Symantec Messaging Gateway instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "SynacorZimbraCollaborationSuite",
"remediationGuidance": "1. Evaluate if Zimbra Collaboration Suite by Synacor Plus should be directly accessible from the internet.\n2. Ensure the management interface is not exposed to the internet.\n3. Where possible restrict access and ensure multifactor authentication (MFA) is enforced.\n4. Further mitigation advice can be followed from CISA https://www.cisa.gov/uscert/ncas/alerts/aa22-228a"
},
{
"issueTypeId": "SynologyVPNPlusServer",
"remediationGuidance": "VPN clients should be monitored closely, as they can provide threat actors a foothold into an organization&#39;s network. Synology VPN Plus Server comes equipped with a number of different settings that can help secure the device:\n\n1. Utilize VPN Plus Server&#39;s traffic monitoring functionality. Setup alerts that trigger on suspicious behavior.\n2. Carefully manage user permissions, and limit access to the VPN only to trusted users.\n3. Work with IT to ensure this device is using a secure protocol. Certain protocols may require more maintenance than others. For instance, it is recommended to not use PPTP due to security concerns."
},
{
"issueTypeId": "TeleconferencingAndCollaboration",
"remediationGuidance": "Teleconferencing and collaboration devices provide access to highly sensitive information and are are often targeted by malicious actors. As such, they should be the subject of security hardening.\n\n1. Identify the exposed teleconferencing and collaboration devices and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\n2. Maintain teleconferencing and collaboration systems behind a firewall or through a VPN.\n3. If your organization&#39;s teleconferencing and collaboration devices need to be exposed to the internet, then using high-entropy passwords, role-based access, encryption, lockout policy, and traffic inspection is recommended.\n4. Teleconferencing and collaboration devices security best practices from CISA can be followed https://www.cisa.gov/sites/default/files/publications/CISA_Guidance_for_Securing_Video_Conferencing_S508C.pdf."
},
{
"issueTypeId": "TelerikWebUI",
"remediationGuidance": "Telerik Web UI components are vulnerable to several critical vulnerabilities that have been exploited by known threat actors, such as https://nvd.nist.gov/vuln/detail/CVE-2019-18935. Successful exploitation of Telerik vulnerabilities could lead to remote code execution, and attackers may be able to gain full access to the application.\n\nXpanse recommends updating Telerik to the latest version. More security mitigations are available in https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a."
},
{
"issueTypeId": "TelnetServer",
"remediationGuidance": "1. Best practice is to not have Telnet exposed to the internet and where possible replace with Secure Shell (SSH).\n2. Evaluate if there is any PII or sensitive information on the appliance to understand the impact of Telnet transmitting unencrypted information.\n3. Evaluate all devices utilizing Telnet and take a risk-based approach around the need for Telnet.\n4. Where possible replace existing Telnet usage with SSH. If this is not feasible follow recommended guidelines set forth by the manufacturer to mitigate Telnet exposure."
},
{
"issueTypeId": "TenableNessus",
"remediationGuidance": "Tenable Nessus has a number of associated CVEs including CVE-2022-32973, which could lead to threat actors executing commands with administrator privileges. Exploitation could lead to sensitive data exposure.\n\nIt is recommended that organizations remove all publicly accessible instances of Nessus, unless there is a clear business need.\nUpgrade Nessus to the latest secure version. Release information can be found with the https://docs.tenable.com/Nessus.htm."
},
{
"issueTypeId": "TenableSC",
"remediationGuidance": "Tenable.sc is vulnerable to a number of XSS(CVE-2023-24494), SSRF(CVE-2023-24495), LDAP injection(CVE-2023-0476), and formula injection(CVE-2023-24493) exploits. In order to remain secure:\n\n* Upgrade to the latest version of Tenable.sc.\n* Determine if this asset should be accessible on the public internet. In most cases, Tenable.sc should only be accessible on an internal, monitored network.\n* https://www.tenable.com/security should be actively monitored for critical updates."
},
{
"issueTypeId": "TendaRouter",
"remediationGuidance": "Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "TftpServer",
"remediationGuidance": "In most cases, TFTP should not be used because it provides no built in security or authentication mechanisms. Therefore, the recommended course of action is to immediately remove TFTP from public access. Consider implementing a more secure file transfer protocol, such as FTPS or SFTP.\n\nhttps://datatracker.ietf.org/doc/html/rfc7440#section-7 details security risks associated with TFTP and possible workarounds."
},
{
"issueTypeId": "ThinkPHPApplication",
"remediationGuidance": "To secure ThinkPHP applications, it is recommended to perform the following:\n\n1. Isolate ThinkPHP applications from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all ThinkPHP applications should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that ThinkPHP applications are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on ThinkPHP applications. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ThreeCXIPPhoneSystem",
"remediationGuidance": "Exposing 3CX Phone System to the public internet makes organizations vulnerable to Denial of Service (DoS), brute force attacks, and man-in-the-middle (MitM) attacks.\n\nXpanse recommends taking the following steps to remediate exposed instances of 3CX IP Phone System:\n\n1. Minimize network exposure by deploying 3CX behind a firewall and ensure it is not accessible from the internet. Block unauthorized traffic and regularly monitor network traffic.\n2. When remote access is required, further limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system and that access is granted on a need-to-know basis.\n3. Keep 3CX hardware and software up to date by regularly applying patches and updates in order to address known vulnerabilities.\n4. Disable unused integrations to limit the platform&#39;s attack surface."
},
{
"issueTypeId": "TibcoJasperServer",
"remediationGuidance": "TIBCO JasperServer is vulnerable to a number of CVEs, including CVE-2018-5430 and CVE-2018-18809, two improper path traversal vulnerabilities. Exploitation could lead to a threat actor viewing arbitrary files on the server. To best protect your organization:\n1. Configure the security settings in TIBCO JasperServer to restrict access to sensitive data and features. For example, limit user access to reports and dashboards based on their roles and responsibilities.\n2. Implement security best practices, such as strong passwords, two-factor authentication, and regular security audits. Train users on how to recognize and report security incidents.\n3. Monitor your TIBCO JasperServer instance for any unusual activity or signs of a security breach. Use logging and monitoring tools to track user activity and detect potential threats.\n4. Upgrade to the latest secure version of JasperServer."
},
{
"issueTypeId": "TikTokPixel",
"remediationGuidance": "Although its stated purpose is to measure the effectiveness of online advertising, the TikTok pixel tracker collects data indiscriminately across the public internet for both TikTok users and non-users. Having the TikTok Pixel configured on your organization’s assets or allowing its tracker to collect data from your organization’s domains carries a significant risk of critical information being harvested or leaked.\n\nEven though TikTok provides different tiers of data protection, no configuration of the TikTok Pixel is considered safe, and it is strongly recommended to discontinue using this tool.\n\nTo block TikTok from using the Pixel trackers on your assets, Xpanse recommends placing these assets behind a VPN so they’re no longer publicly accessible. If a business case requires these assets to be public, then it is best practice to use a firewall rule to monitor and block traffic from TikTok, which would include attempts by the TikTok Pixel to collect data."
},
{
"issueTypeId": "TomcatWebServer",
"remediationGuidance": "Tomcat web servers are vulnerable to numerous types of attacks, the most impactful being DoS and information disclosure vulnerabilities such as https://nvd.nist.gov/vuln/detail/CVE-2023-34981 and https://nvd.nist.gov/vuln/detail/CVE-2021-30639. A compromised Tomcat web server may lead to significant service interruptions and potential data leaks of internal server information.\n\nTo keep Tomcat web servers secure, it is recommended to perform the following:\n\n1. Isolate Tomcat web servers from the public internet by placing them behind a VPN.\n2. If a strong business case exists for public accessibility, all Tomcat web servers should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Tomcat web instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Tomcat instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "TPLinkDevice",
"remediationGuidance": "Routers and networking infrastructure are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\n\nXpanse recommends performing the following steps to remain secure:\n\n1. Ensure the router’s administration panel is not publicly exposed to the internet.\n2. Routinely update the router’s firmware by installing the vendor’s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\n3. Replace the default username and password with robust, unique credentials.\n4. Turn off remote management features to prevent unauthorized external network access.\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly."
},
{
"issueTypeId": "TrellixEnterpriseSecurityManager",
"remediationGuidance": "Trellix Enterprise Security Manager is exposed to CVE-2023-3314, a high severity command injection vulnerability. In order to maintain network security Xpanse recommends the following:\n\n1. Remove instances of Trellix Enterprise Security Manager from the public facing internet. This software should be reserved for internal use only for authorized users.\n2. Upgrade to the latest secure version. Upgrading to version 11.6.7 will protect against CVE-2023-3314.\n3. Restrict access to the application to approved users on a minimum access policy. This will prevent threat actors who may have infiltrated your internal environment from escalating their privileges.\n4. Visit the vendor https://kcm.trellix.com/corporate/index?page&#61;content&amp;id&#61;SB10403 for CVE-2023-3314 for further information and mitigation techniques."
},
{
"issueTypeId": "TrendIWSVirtualGateway",
"remediationGuidance": "It is recommended to evaluate whether this device should be exposed to the public internet. If it is found that this device should not be exposed, identify the asset owner and work with them to remove the device from being accessible from the public internet."
},
{
"issueTypeId": "UbiquitiDevice",
"remediationGuidance": "There are a number of CVEs associated with Ubiquiti devices, notably CVE-2020-8234 which can lead to command injection. Specific security recommendations will depend on the identified product.\n\nWhile networking devices are generally expected to be on the public facing internet:\n\n* Ensure that you are running the latest security update.\n* Monitor the device for malicious traffic.\n* If applicable, implement an access control list to only allow trusted devices to connect to the Ubiquiti device."
},
{
"issueTypeId": "UnclaimedGoogleAppEngineServices",
"remediationGuidance": "It is recommended to remove the CNAME record that points to the unclaimed Google App Engine service in order to remediate this issue."
},
{
"issueTypeId": "UnclaimedS3Bucket",
"remediationGuidance": "Unclaimed Amazon S3 Buckets lead to subdomain takeover, which often happens when a developer or engineer removes a cloud resource but does not delete the corresponding DNS record.\n\n1. DNS records should be reviewed on a regular basis. Stale and unused DNS entries should be identified and removed.\n2. The practice of reviewing DNS records should be included in the workflow of engineering or development teams whenever a service is discontinued to ensure all associated DNS entries, hostnames, and subdomains are removed."
},
{
"issueTypeId": "UnencryptedFtpServer",
"remediationGuidance": "1. Identify the service owner and business purpose.\n 2. Evaluate if there is any PII or sensitive information on the server to understand the impact of the FTP Server transmitting unencrypted information.\n 3. Evaluate if this FTP Server needs to be exposed to the public internet for business purposes.\n 4. If the server does need to be exposed to the public internet or an internal network, Xpanse recommends reconfiguring the server to only accept encrypted FTPS connections or decommissioning the FTP Server and switching to a more modern secured and encrypted file transfer technology.\n 5. If the server does not need to be exposed, it should be decommissioned and removed from the network."
},
{
"issueTypeId": "UnencryptedLogin",
"remediationGuidance": "Insecure login forms make your organization vulnerable to interception attacks. Secure this process by serving login landing pages over HTTPS with HSTS enabled. This will prevent attackers from stealing plain text credentials by sniffing the network or interfering with the page in transit.\n\nFurther documentation:\n * https://developer.mozilla.org/en-US/docs/Web/Security/Insecure_passwords\n * https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html"
},
{
"issueTypeId": "UpnpServer",
"remediationGuidance": "Unpatched, misconfigured, and public facing UPnP Servers pose a serious security risk. This is primarily due to the lack of authentication performed by UPnP.\n\nDo not utilize UPnP if possible. Instead manually port forward services and devices in your network as needed.\n\nIf your organization requires the use of UPnP take the following steps to mitigate risk:\n1. Ensure the services are not publicly accessible.\n2. Ensure robust logging is enabled on the asset hosting the UPnP services and your network devices to monitor for nefarious activities such as data exfiltration, malware delivery, staging, rogue services, etc.\n3. Place UPnP behind network security devices on your edge (such as WAFs) and enable monitoring on these devices along with DDoS mitigation and allow-listing functions."
},
{
"issueTypeId": "VeeamBackupAndReplication",
"remediationGuidance": "Veeam Backup and Replication is vulnerable to CVEs such as CVE-2023-27432, which allows encrypted credentials to be stolen. If you have identified a publicly exposed Veeam Backup and Replication server, here are some steps you can take to remediate the situation:\n\n1. Immediately disconnect the server from the internet to prevent any further unauthorized access.\n2. Conduct a thorough security assessment of the server to identify any potential vulnerabilities and determine if any data has been compromised.\n3. Apply all necessary security patches and updates to the server and ensure that all software and applications are up to date.\n4. Implement strong authentication and access controls to prevent unauthorized access.\n5. Consider implementing additional security measures such as firewalls, intrusion detection and prevention systems, and data encryption.\n6. Regularly monitor the server for any suspicious activity or unauthorized access attempts.\n\nVendor recommendations can be found https://bp.veeam.com/vbr/Security/."
},
{
"issueTypeId": "VeritasDevice",
"remediationGuidance": "Certain Veritas devices are vulnerable to high impact CVEs. Some of the most notable vulnerabilities are CVE-2022-42307 and CVE-2022-46414, an XML external entity (XXE) injection attack and an unauthenticated remote command execution (RCE) attack respectively.\n\nIt is recommended to identify the device&#39;s specific product / model in order to determine vulnerability and remediate the risk."
},
{
"issueTypeId": "VMwareCarbonBlackAppControl",
"remediationGuidance": "VMware Carbon Black App Control should not be accessible on the public internet. If breached, it could allow attackers to gain detailed information about an organization&#39;s network. Specific versions of VMware Carbon Black App Control are vulnerable to an authentication bypass, remote code execution and file upload exploits via CVE-2021-21998, CVE-2022-22951 and CVE-2022-22952 respectively. VMware security advisories, including those affecting VMware Carbon Black App Control, can be found https://www.vmware.com/security/advisories.html."
},
{
"issueTypeId": "VMwareCloudDirector",
"remediationGuidance": "VMware Cloud Director is vulnerable to a number of CVEs including CVE-2022-22966, which can lead to remote code execution. While VMware Cloud Director tenant portals are expected to be public facing, ensure the instance is running the latest security patches.\n\nDetailed security recommendations can be found in the https://docs.vmware.com/en/VMware-Cloud-Director/Security/VMwre_Cloud_Director_Security_Guide.pdf."
},
{
"issueTypeId": "VMwareESXi",
"remediationGuidance": "Compromise of an ESXi server can lead to an attacker gaining control of large aspects of an organizations infrastructure as these devices are typically used as a hypervisor to host a wide variety of Virtual Machines (VMs).\n\nIdeally, this system should not be exposed to the internet at all.\nIf it needs to be exposed for a business reason, it is recommended to put the device behind security controls such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled.\n\nFurther security recommendations can be found in VMware&#39;s documentation https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-B39474AF-6778-499A-B8AB-E973BE6D4899.html. Ensure that the flagged version matches the version listed in the documents."
},
{
"issueTypeId": "VMwareSpringFramework",
"remediationGuidance": "Specific environments of the Spring Core Framework contain a remote code execution vulnerability, steps to reduce the probability of such attempts include the following:\n\n1. Evaluate whether the vulnerability exists on your system. Information on the requirements for exploitation of the vulnerability can be found at https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#am-i-impacted.\n2. Best practice is to update to current versions, as outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Spring Framework. Latest updates can be found at https://spring.io/blog/category/releases.\n3. If incremental updates cannot be achieved, temporary workarounds include: updating Apache Tomcat to 10.0.20, 9.0.62, or 8.5.78; downgrading to java 8, if upgrading the Spring Framework or Apache Tomcat is not possible; as well as disabling binding to certain fields by setting the disallowedFields option. This is explained in more detail at https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds."
},
{
"issueTypeId": "VMwareUnifiedAccessGateway",
"remediationGuidance": "If you have discovered an exposed and vulnerable instance of VMware Unified Access Gateway, you should take the following steps to remediate the vulnerability:\n\n1. Quarantine the vulnerable device to prevent further potential exploits, lateral movement, data loss, or footholds in your environment.\n2. Identify the specific vulnerability affecting the instance of VMware Unified Access Gateway.\n3. Once you have identified the vulnerability, apply any available patches or updates to the instance of VMware Unified Access Gateway to remediate the vulnerability.\n4. Ensure that the instance of VMware Unified Access Gateway is configured with appropriate security settings, such as SSL encryption, two-factor authentication, and access controls.\n5. Review logs associated with the device to include network logs, application logs, IPS/IDS logs, EDR logs, OS logs, etc. to determine if any compromise as a result of the vulnerable VMware UAG took place. Then contain, eradicate, and remediate appropriately.\n6. Continue to monitor all instances of VMware Unified Access Gateway for future vulnerabilities and apply patches and updates as necessary to ensure ongoing proficient security."
},
{
"issueTypeId": "VMwareVCenterAdminPage",
"remediationGuidance": "Identify the owner of the affected asset and determine if there is a legitimate business need to have this service exposed to the internet.\nIf not, work with the asset owner to remove the device from the internet.\n\nIf the device has a legitimate business need to be exposed to the internet, it is best practice to enable Two-Factor Authentication / Single Sign-on.\nDocumentation for setup can be found here: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-ACFFCBEC-6C1C-4BF9-9971-04AEE9362AFE.html\nEnsure document version matches the one displayed in the affected asset"
},
{
"issueTypeId": "VMwareVRealizeAutomationAppliance",
"remediationGuidance": "Due to the network access provided by VMware vRealize Automation, it is recommended for instances of VMware vRealize Automation to not be accessible to the public Internet unless there is a business need.\nXpanse recommends working to identify the asset owner and collaborating with them to remove the asset from the internet."
},
{
"issueTypeId": "VMwarevRealizeLogInsight",
"remediationGuidance": "VMware Aria Operations for Logs (formerly VMware vRealize Log Insight) if left unpatched or misconfigured poses a significant security risk to your organization. Log Insight has had recent vulnerability disclosures that include cross-site scripting. It is recommended to take the following steps to secure your instance of VMware vRealize Log Insight:/n/n1. Ensure you are running the latest available version of Log Insight./n2. Ensure your instance of VMware vRealize Log Insight is not publicly visible./n3. If your instance of VMware vRealize Log Insight must be public facing, ensure it lies behind security devices such as a Palo Alto&#39;s Prisma Access./n4. Ensure you have verbose logging on VMware vRealize Log Insight to detect nefarious activities should they take place."
},
{
"issueTypeId": "VMwareVRealizeNetworkInsight",
"remediationGuidance": "VMware vRealize Network Insight is vulnerable to CVE-2022-31702 and CVE-2022-31703, which are command injection and directory traversal vulnerabilities respectively. Due to this:\n1. Ensure that the vRealize Network Insight (vRNI) installation is up to date with the latest version.\n2. Review the vRNI system logs for any errors or warnings.\n3. Implement security best practices for vRNI, such as using strong passwords, restricting access to only authorized users, and enabling two-factor authentication.\n4. Monitor the vRNI system for any suspicious activity or unauthorized access."
},
{
"issueTypeId": "VMwareVRealizeOperations",
"remediationGuidance": "Determine whether this asset should be exposed to the public internet or not.\nAfterwards, work with the asset owner to restrict access should it be determined that the asset should not be publicly accessible."
},
{
"issueTypeId": "VMwarevRealizeOrchestrator",
"remediationGuidance": "If an attacker gains access to a VMware vRealize Orchestrator (vRO) instance, they can access sensitive information, disrupt services, modify workflows, spread malware, and escalate privileges within the VMware environment. This puts the organization&#39;s data, operations, and network at risk.\n\nIt is recommended to perform the following in order to remain secure:\n1. Restrict vRO access by placing it in a secure network zone and allowing only authorized connections.\n2. Implement strong, unique credentials, multi-factor authentication, and enforce least privilege access.\n3. Enable encryption for data in transit (using TLS) and data at rest (e.g., vSAN encryption).\n4. Regularly update and patch vRO, underlying OS, and integrated components to address security vulnerabilities.\n5. Configure logging, monitor for suspicious activities, apply VMware&#39;s security hardening guidelines, and perform regular security assessments."
},
{
"issueTypeId": "VMwareWorkspaceOneAccessServer",
"remediationGuidance": "VMware Workspace ONE Access has been impacted by a number of security vulnerabilities, including Log4Shell. To protect against these security risks:\n\n* Determine if this instance of VMware Workspace ONE Access must be accessible on the public internet. If not, work with the asset owner to limit access.\n* Determine which version is being run. VMware Workspace ONE Access does not always broadcast version information. If this instance is running an old patch upgrade to the latest secure version."
},
{
"issueTypeId": "VMwareWorkspaceOneAdministrativeConfigurator",
"remediationGuidance": "This issue identifies the web administration portals of VMware Identity Manager and Workspace ONE Access. Version numbers are identified where available.\n\nPer CVE-2020-4006, VMWare Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a Command Injection Vulnerability in the administrative configurator. A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system. This account is internal to the impacted products and a password is set at the time of deployment. A malicious actor must possess this password to attempt to exploit CVE-2020-4006.\n\nThe NSA, FBI, and CISA identified VMware Workspace One Access on April 15, 2021, as a service impacted by one of the five vulnerabilities most frequently targeted by Russian SVR cyber operations."
},
{
"issueTypeId": "VMwareWorkspaceONEUEM",
"remediationGuidance": "VMware Workspace One UEM when misconfigured and/or unpatched poses a security risk to your organization. Take the following steps to secure your instance of Workspace One UEM:\n\n1. Ensure your instance of Workspace One UEM is updated to the latest available version.\n2. Place Workspace One UEM behind security tools such as a WAF.\n3. Do not make access to Workspace One UEM public."
},
{
"issueTypeId": "VncServer",
"remediationGuidance": "In general, VNC should not be directly exposed to the Internet as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.\nThe following should be evaluated and performed:\n\n1. Disable or remove the service from the internet.\n2. Review whether VNC is absolutely necessary and see if tunneling VNC over SSH or a VPN can be utilized instead.\n3. Use VNC implementations that encrypt the entire VNC session, including password authentication and data transfer."
},
{
"issueTypeId": "VpnDevice",
"remediationGuidance": "VPN Devices are expected to be publicly accessible. To improve network security, consider the following:\n\n* Monitor the VPN for for anomalous behavior.\n* Consider implementing access control lists to ensure only trusted users are able to access the device.\n* Enforce strong passwords, and ensure there are lockout mechanisms in place.\n* Run the latest security patches."
},
{
"issueTypeId": "WatchGuardFirebox",
"remediationGuidance": "If for any reason it is determined that this device should not be publicly exposed to the internet, identify the asset owner and work to restrict access to the device."
},
{
"issueTypeId": "WatchGuardXtmAppliance",
"remediationGuidance": "Instances of WatchGuard XTM are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly configured WatchGuard XTM appliance could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\n\nXpanse recommends performing the following steps to keep instances of WatchGuard XTM secure:\n\n. Ensure WatchGuard XTM’s administration panel is not publicly exposed to the internet.\n2. Routinely update WatchGuard XTM devices to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\n3. Audit open ports and running services and ensure that anything active is critical for firewall and VPN functionality to run effectively and safely.\n4. Monitor WatchGuard XTM traffic to identify suspicious activity or unauthorized access attempts."
},
{
"issueTypeId": "Weaveworks",
"remediationGuidance": "Having a misconfigured or unpatched instance of Weave Scope or GitOps poses a serious risk to your organization. Both products offered by Weave contain sensitive information that should never be publicly exposed. The following steps are recommended to secure your Weave products:\n\n1. Ensure you do not have any instance of Weave Scope or GitOps publicly accessible.\n2. Ensure access to your instance of Weave Scope or GitOps are behind security devices such as a WAF.\n3. Ensure you have verbose logging enabled on your Weave products to detect threats involving these products to your organization.\n4. Ensure you are utilizing best practices for access control to these tools."
},
{
"issueTypeId": "WebLogin",
"remediationGuidance": "This policy flags all login pages that are publicly exposed on the internet, including user and admin logins. Login panels are not inherently vulnerable, but having them publicly accessible poses significant security risks, like being breached or leaking sensitive information.\n\nXpanse recommends that all servers hosting login landing pages in your organization are placed behind a Web Application Firewall (WAF) and not publicly accessible.\n\nIf it is determined that a particular server exposing login pages does need to be publicly exposed, then it is recommended to take the following steps to secure your login interfaces:\n\n1. Ensure that login landing pages are served over HTTPS with HSTS enabled. This security measure will prevent attackers from stealing plain text credentials by sniffing the network or interfering with the page in transit.\n2. Review password policies and disable default passwords that can be easily guessed or discovered.\n3. Review access policies and ensure the principle of least privilege is applied in existing controls.\n4. Implement input validation and sanitization to prevent cross-scripting and SQL injection attacks.\n5. Ensure the application isn’t leaking internal information that would give enough context to an attacker to brute-force their way into the system (like user-enumeration). Failed logins should not expose more details other than the failure itself; how and what failed should not be explained in more detail either in the user-facing messaging or in the application logs.\n\nMore detailed guidelines can be found in the https://owasp.org/www-community/OWASP_Application_Security_FAQ."
},
{
"issueTypeId": "WhatsUpGold",
"remediationGuidance": "If an attacker gains access to an exposed WhatsUp Gold instance, they can potentially gather sensitive network information, manipulate monitoring configurations, disrupt network operations, and launch further attacks on the organization&#39;s infrastructure, ultimately compromising the network&#39;s security and performance.\n\nIn order to remain secure it is recommended to perform the following:\n1. Update the software to the latest version.\n2. Replace default credentials with strong, unique ones.\n3. Restrict remote management access.\n4. Implement IP-based access control.\n5. Configure secure communication protocols.\n6. Regularly review logs for suspicious activity.\n\nMore information regarding configuration of the product can be found in the https://docs.ipswitch.com/en/whatsup-gold.html."
},
{
"issueTypeId": "WildcardCertificate",
"remediationGuidance": "The use of wildcard certificates carry significant security risks. It is recommended that each distinct service on a network has their own unique certificate.\n\nAdditional guidance: https://www.bleepingcomputer.com/news/security/nsa-warns-of-wildcard-certificate-risks-provides-mitigations/#:~:text&#61;MItigating%20wildcard%20certificate,their%20latest%20version."
},
{
"issueTypeId": "WinRM",
"remediationGuidance": "If an attacker gains access to an exposed WinRM service, they can potentially execute arbitrary commands on the target system, access sensitive information, manipulate system configurations, and move laterally within the network. This can lead to unauthorized access, data breaches, and loss of control over the affected machines, severely compromising the security of the environment.\n\nIn order to remain secure, it is recommended to perform the following:\n1. Disabling WinRM when not required is a crucial step in preventing unauthorized access.\n2. Configuring firewall rules to limit inbound access to the WinRM service only from trusted IP addresses or subnets can help reduce the attack surface.\n3. Implementing strong authentication methods, such as Kerberos or certificate-based authentication, ensures only authorized users can access WinRM. It is important to avoid using Basic or NTLM authentication, as they are less secure.\n4. Enabling encryption for data transmitted between the client and server by enforcing HTTPS instead of HTTP for WinRM communication is essential. This can be achieved by configuring the WinRM listener to use an SSL certificate.\n5. Regularly auditing and monitoring WinRM logs and settings to detect unauthorized access attempts, configuration changes, or other suspicious activities is necessary. It is also important to implement monitoring tools to proactively identify and respond to security threats."
},
{
"issueTypeId": "WordPressAdminPage",
"remediationGuidance": "WordPress is a frequently targeted content management system. While there are multiple mitigations that organizations can take, the following should be done at a minimum:\n\n1. Use a web application firewall to block external access to the WordPress Admin page.\n2. Password protect the WordPress Admin directory.\n3. Enable two factor authentication in WordPress.\n4. Limit the number of login attempts.\n5. Enforce IP allow-listing to specific IPs.\n6. Limit dashboard access to certain users.\n7. In general, keep WordPress updated.\n\nhttps://wordpress.org/support/article/hardening-wordpress/"
},
{
"issueTypeId": "WordpressServer",
"remediationGuidance": "Exploitation of a Wordpress website can have a multitude of impacts ranging from information disclosure to remote code execution.\n1. The type of remediation required to secure a Wordpress website may differ based on the use case, plugins, and configuration.\n2. Vendor recommendations can be found on the https://wordpress.com/support/security/.\n3. In general, ensure that you are running the latest software updates and are tracking Wordpress security advisories. Wordpress security releases can be found on the https://wordpress.org/news/category/security/."
},
{
"issueTypeId": "WordPressSocialWarfarePlugin",
"remediationGuidance": "Social Warfare is a web plugin and is expected to be publicly visible on the internet. Xpanse recommends always running the latest version of this plugin to safeguard against remote code execution attacks."
},
{
"issueTypeId": "XiaomiRouter",
"remediationGuidance": "Certain models and versions of Xiaomi routers are susceptible to security vulnerabilities, such as CVE-2018-13023 (a system command injection vulnerability).\n\nIf this device is vulnerable, upgrade to a secure patch. Evaluate whether or not this device should be exposed to the public internet. If is determined that this device should not be exposed to the public internet, identify the asset owner and work with them to remove the device from being publicly accessible."
},
{
"issueTypeId": "XmppServer",
"remediationGuidance": "XMPP servers should not be accessible on the public internet. If an attacker gains access to an XMPP server, they could view the company structure, perform service discovery, and read messages with confidential information. If an XMPP server must be accessible on the public internet, ensure that:\n\n 1. The server is running with a server certificate.\n 2. The server is configured to not allow any cleartext client-to-server or server-to-server communications.\n 3. The server supports XEP-0198 and XEP-0124 protocol extensions.\n 4. Action is taken to prevent denial of service attacks, such as limiting the amount of connections from a single client."
},
{
"issueTypeId": "XWiki",
"remediationGuidance": "If you have identified a vulnerable and exposed instance of XWiki, the following steps can help you remediate the issue:\n\n1. Disconnect the device from the network to prevent any further unauthorized access or compromise.\n2. Analyze the device and review any available logs to determine if any level of compromise took place. If a compromise has taken place, take the appropriate steps to contain, eradicate, and remediate the device.\n3. Make sure you have the latest version of XWiki installed, as newer versions often include security patches that address known vulnerabilities.\n4. Disable any unused features in XWiki to reduce the attack surface.\n5. Review the access controls for your XWiki instance and ensure that only authorized users have access to sensitive data.\n6. Ensure you have proper security controls in place such as firewalls, intrusion detection systems, and antivirus software.\n7. Regularly monitor your XWiki instance for any suspicious activity, such as unauthorized access attempts or unusual data transfers."
},
{
"issueTypeId": "YealinkNetworkingDevice",
"remediationGuidance": "To secure Yealink Networking devices, it is recommended to perform the following:\n\n1. Isolate Yealink Networking devices from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Yealink Networking devices should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Yealink Networking devices are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Yealink Networking devices. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ZabbixITMonitoringSystem",
"remediationGuidance": "To secure Zabbix instances, it is recommended to perform the following:\n\n1. Isolate Zabbix instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Zabbix instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Zabbix instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Zabbix instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ZKWebFramework",
"remediationGuidance": "The following actions are recommended to keep your ZK built webpage secure:\n\n1. Ensure that all user inputs are validated on both the client and server sides to prevent any malicious code or SQL injections.\n2. Implement a secure authentication mechanism to verify the identity of the user before providing access to sensitive information or features\n3. Use HTTPS to encrypt all data communication between the server and client to prevent eavesdropping and man-in-the-middle attacks.\n4. Avoid storing sensitive information such as passwords or personal details on the client-side. Instead, store them on the server-side and use secure mechanisms to retrieve and transfer the data as needed.\n5. Keep the ZK framework and any third-party libraries up to date with the latest security patches to protect against known vulnerabilities.\n6. Follow secure coding practices such as avoiding hard-coded passwords or credentials, limiting the use of global variables, and using parameterized SQL queries to prevent SQL injections."
},
{
"issueTypeId": "ZohoManageEngineAccessManagerPlus",
"remediationGuidance": "Zoho ManageEngine Access Manager Plus when unpatched and misconfigured poses a serious security risk to any organization as severe vulnerabilities have been recently released including remote code execution (RCE).\n\n1. The Zoho ManageEngine Access Manager Plus application should be behind security controls such as a WAF. In addition Xpanse recommends enabling access filtering such as IP allow-listing, essentially implementing ZeroTrust access.\n\n2. Ensure monitoring is configured to detect nefarious activities such as data exfiltration, and exploit attempts.\n\n3. Zoho ManageEngine Access Manager Plus best practices can be followed at https://manageengine.optrics.com/access-manager-plus.aspx"
},
{
"issueTypeId": "ZohoManageEngineAD360",
"remediationGuidance": "Zoho ManageEngine AD360 is known to be vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2022-47966 and https://nvd.nist.gov/vuln/detail/CVE-2020-24786 attacks, which could put your organization at risk of being breached or experiencing a significant service interruption.\n\nDue to the sensitivity of the data managed by Zoho ManageEngine AD360, Xpanse recommends that all instances of Zoho ManageEngine AD360 should be placed behind a firewall or VPN and should receive timely patch updates."
},
{
"issueTypeId": "ZohoManageEngineADSelfServicePlus",
"remediationGuidance": "1. Best practice is to not have Zoho ManageEngine ADSelfService Plus directly accessible from the internet. \n2. Evaluate if Zoho ManageEngine ADSelfService Plus needs to be exposed to the public internet for business purposes.\n3. If Zoho ManageEngine ADSelfService Plus does need to be accessible from the internet follow the Admin guide from ManageEngine to ensure it is secured properly. \n4. If it does not need to be accessible from the internet follow recommendations from ManageEngine. \n5. ManageEngine Guidance can be found here. https://www.manageengine.com/products/self-service-password/self-service-password-help-docs.html?topMenu"
},
{
"issueTypeId": "ZoHoManageEngineDesktopCentral",
"remediationGuidance": "To secure Zoho ManageEngine Desktop Central instances, it is recommended to perform the following:\n\n1. Isolate Zoho ManageEngine Desktop Central instances from the public internet by placing them behind a VPN.\n2. If there is a strong business case for public accessibility, all Zoho ManageEngine Desktop Central instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\n4. Ensure that Zoho ManageEngine Desktop Central instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Zoho ManageEngine Desktop Central instances. Regularly review access logs and server configurations to ensure security best practices are followed."
},
{
"issueTypeId": "ZohoManageEngineOpManager",
"remediationGuidance": "Determine whether this asset should be exposed to the public internet or not.\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible."
},
{
"issueTypeId": "ZohoManageEnginePAM360",
"remediationGuidance": "Zoho ManageEngine PAM360 should not be accessible on the public internet. Critical vulnerability CVE-2021-44525 affects builds before 5500 and allows for users to bypass authentication. In addition to removing public access, ensure that PAM360 is upgraded to the latest secure version."
},
{
"issueTypeId": "ZohoManageEnginePasswordManagerPro",
"remediationGuidance": "Due to the sensitive nature of the data that can be stored within this asset, it is recommended to not have this device be publicly accessible.\nIf it is found that the flagged asset is mistakenly exposed to the public internet, work to identify the asset owner and restrict the device from being publicly accessible.\nIf the device needs to be internet facing for a business purpose, it is recommended to put it behind a security device such as a Web Application Firewall (WAF)."
},
{
"issueTypeId": "ZyxelFirewall",
"remediationGuidance": "Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\n\nXpanse recommends performing the following steps to keep firewall devices secure:\n\n1. Ensure the firewall’s administration panel is not publicly exposed to the internet.\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts."
}
]

Source

list-RemediationGuidance.json

Download History Raw

{
    "allRead": true,
    "allReadWrite": true,
    "data": "[\n    {\n        \"issueTypeId\": \"AcclaimSystemsUSAHERDS\",\n        \"remediationGuidance\": \"USAHERDS has been the target of aggressive attack campaigns by Chinese espionage group APT41 and, since it\u2019s a valuable entrypoint into government systems, malicious actors may attempt exploiting instances of this product that are publicly exposed.\\n\\nXpanse recommends securing your organization\u2019s instances of USAHERDS by taking the following steps:\\n\\n1. Verify whether it is necessary for USAHERDS to be publicly accessible on the internet. Should it be deemed necesary to have public exposure, then it is considered a best practice to place assets behind a Web Application Firewall (WAF).\\n2. Confirm which version of USAHERDS is running on your asset. Any version before 7.4.0.1 (inclusive) is vulnerable to CVE-2021-44207 and could lead to remote code execution from malicious actors. If you are running a vulnerable version, upgrading to the latest version is strongly recommended.\"\n    },\n    {\n        \"issueTypeId\": \"AdobeColdFusion\",\n        \"remediationGuidance\": \"Adobe ColdFusion is vulnerable to authentication bypass and remote code execution vulnerabilities, such as https://nvd.nist.gov/vuln/detail/CVE-2023-26360 and https://nvd.nist.gov/vuln/detail/CVE-2023-38203, and has been frequently exploited in the wild. Motivated attackers could gain unauthorized access to instances of Adobe ColdFusion and may have visibility of all applications managed by the exploited ColdFusion instance.\\n\\nXpanse recommends running only the latest version of ColdFusion and applying security patches as soon as they become available. Ideally, access to ColdFusion devices would be protected by a secure access gateway or proxy to prevent unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"AdobeCommerce\",\n        \"remediationGuidance\": \"To secure Adobe Commerce instances, it is recommended to perform the following:\\n\\n1. Isolate Adobe Commerce instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Adobe Commerce instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Adobe Commerce instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Adobe Commerce instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"AdobeFlash\",\n        \"remediationGuidance\": \"1. Best practice is to not expose end of life (EOL) software to the internet.\\n2. Evaluate all devices utilizing Adobe Flash Player and where possible remove all existing Adobe Flash Player installations.  https://www.adobe.com/products/flashplayer/end-of-life.html\"\n    },\n    {\n        \"issueTypeId\": \"AjpServer\",\n        \"remediationGuidance\": \"The Apache JServ Protocol (AJP) is a protocol that can proxy inbound requests from a web server to an application server that sits behind the web server. AJP should never be exposed to the internet.\\n\\n1. Identify the exposed server running AJP and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Secure the network by blocking outbound AJP on TCP port 8009.\\n3. It is recommended to define the strong secret key attribute requiredSecret in server.xml. This sets AJP protocol authentication credentials and ensures that only requests from authenticated workers will be honored\\n4. Any instance of Apache Tomcat server should be updated to the latest version which will also update AJP.\\n5. AJP / Tomcat server security best practices can be followed https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html.\"\n    },\n    {\n        \"issueTypeId\": \"AmazonSimpleStorageService\",\n        \"remediationGuidance\": \"Security best practices for Amazon S3 can be found https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html.\"\n    },\n    {\n        \"issueTypeId\": \"AmcrestTechnologiesCamera\",\n        \"remediationGuidance\": \"As per CVE-2020-5735, Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code. Further assessment is needed by organizations to infer vulnerability since this policy does not detect models, versions, custom configurations, workarounds, or patches that remediate the vulnerability.\"\n    },\n    {\n        \"issueTypeId\": \"AMIMegaRACBMC\",\n        \"remediationGuidance\": \"MegaRAC should not be exposed to the public internet. Threat actors who gain access to MegaRAC would be able to monitor and alter network devices. In order to protect your network, consider the following steps:\\n\\n1. Disconnect MegaRAC from the public facing internet.\\n2. Place the server behind a secure VPN, and limit access to approved server administrators.\\n3. Change all the default passwords. By default, AMI MegaRAC BMC servers come with the default username and password admin:password. Change these credentials to strong, unique passwords that are hard to guess.\\n4. Check if there are any firmware updates available for the BMC and apply them. This will help to patch any known vulnerabilities.\"\n    },\n    {\n        \"issueTypeId\": \"ApacheAirflow\",\n        \"remediationGuidance\": \"To secure Apache Airflow instances, it is recommended to perform the following:\\n\\n1. Isolate Apache Airflow instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Apache Airflow instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Apache Airflow instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Apache Airflow instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ApacheAPISIX\",\n        \"remediationGuidance\": \"Apache APISIX is known to be vulnerable to authentication bypass and remote code execution attacks, most notably https://nvd.nist.gov/vuln/detail/cve-2022-24112, which could lead to malicious actors gaining access to the admin dashboard interface. These types of attacks could allow unauthorized users to bring services offline and/or extract critical information about an organization\u2019s infrastructure.\\n\\nXpanse recommends securing instances of Apache APISIX by following these best practices:\\n\\n1. Place Apache APISIX gateways behind a web application firewall (WAF) and ensure that there are comprehensive rules in place to restrict access only to intended audiences.\\n\\n2. Ensure that Apache APISIX gateways are running on the latest version and implement a patch management process to facilitate applying security updates in a timely manner.\\n\\n3. Implement rate-limiting to prevent traffic overload and Distributed Denial of Service (DDoS) attacks.\\n\\n4. Enable robust logging and closely monitor ingress and egress traffic.\"\n    },\n    {\n        \"issueTypeId\": \"ApacheCoyote\",\n        \"remediationGuidance\": \"Evaluate whether or not this device should be exposed to the public internet. If it is determined that this device should not be exposed to the public internet, identify the asset owner and work with them to remove the device from being publicly accessible.\\n\\nIf this device needs to be exposed to the public internet, it is recommended to put the device behind security tooling such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled.\\n\\nMore information regarding Apache Tomcat and Apache Coyote security configurations can be found https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html.\"\n    },\n    {\n        \"issueTypeId\": \"ApacheDruid\",\n        \"remediationGuidance\": \"It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\\n\\nXpanse recommends securing your database software by taking the following steps:\\n\\n1. Isolate the database from the public internet by placing it behind a VPN.\\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ApacheSuperset\",\n        \"remediationGuidance\": \"If you have identified a vulnerable exposed instance of Apache Superset, there are several steps you can take to remediate the issue:\\n\\n1. Determine the nature and severity of the vulnerability.\\n2. Quarantine or isolate the system from the network to prevent further damage and to protect other systems from being affected.\\n3. If a patch or update is available, apply it to the system as soon as possible. This will help to fix the vulnerability and prevent further exploitation.\\n4. Conduct a thorough security audit of the system to identify any other potential vulnerabilities or weaknesses that may have been exploited.\\n5. Take all necessary steps to eradicate any threat discovered on the system.\\n6. Monitor the system for any signs of continued exploitation or suspicious activity.\\n7. Follow best practices for securing Apache Superset, such as limiting access to the system, using secure configurations, and regularly reviewing logs and audit trails.\\n\\nFor additional information see this https://superset.apache.org/docs/security/\"\n    },\n    {\n        \"issueTypeId\": \"AppleCups\",\n        \"remediationGuidance\": \"1. CUPS servers should not be directly accessible from the internet as they pose a significant risk as vulnerabilities are constantly being found for the service. Evaluate if this CUPS server needs to be exposed to the public internet for business purposes.\\n2. If the server does need to be exposed to the public internet or an internal network, Xpanse recommends reconfiguring the server to leverage the Internet Printing Protocol (IPP) along with Access Control Lists (ACL), authentication, and encrypted communication.\\n3. Configuration of secure IPP can be found https://www.rfc-editor.org/rfc/rfc7472.html.\\n4. Update to the latest secure version.\"\n    },\n    {\n        \"issueTypeId\": \"AraknisNetworks300SeriesRouter\",\n        \"remediationGuidance\": \"If your Araknis Networks 300 series router is found to be exposed take the following steps to remediate:\\n\\n1. Isolate the router from the network to prevent any further damage or compromise.\\n2. Assess the extent of the exposure by reviewing logs and conducting a vulnerability scan. Based on the findings, the following steps can be taken to remediate the exposure:\\n\\n1. Change the default login credentials: If the router is exposed due to the default credentials being left unchanged, the first step would be to change the password to a strong and unique one.\\n2. Update the firmware: Ensure that the router is running on the latest firmware version, which often includes security patches and bug fixes.\\n3. Review the firewall rules: Check the firewall rules to ensure that only necessary ports are open and that the router is not accessible from the internet.\\n4. Disable unnecessary services: Disable any unnecessary services or features that are not being used, as they can increase the attack surface.\\n5. Implement network segmentation: Implement network segmentation to limit the impact of an attack on the router.\\n6. Monitor for any unusual activity: Implement continuous monitoring to detect any unusual activity or anomalies that may indicate a compromise.\\n7. Conduct regular vulnerability assessments: Regularly assess the security posture of the router to ensure that it is protected against the latest threats and vulnerabilities.\"\n    },\n    {\n        \"issueTypeId\": \"ArcadyanBuffaloRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"ArubaAirWave\",\n        \"remediationGuidance\": \"Due to the network management access provided by Aruba AirWave, it is recommended that instances of Aruba AirWave are not accessible to the public internet unless there is a clear business need. If the instance must be publicly accessible, follow the vendor security deployment documents. For example, the AirWave 8.2.14.0 documentation can be found https://www.arubanetworks.com/techdocs/AirWave/82140/AirWave_8.2.14.0_Security_Deployment_Guide.pdf.\\n\\nIt may also be valuable to track the newest vulnerabilities on the https://www.arubanetworks.com/support-services/security-bulletins/ webpage.\"\n    },\n    {\n        \"issueTypeId\": \"AssetOnUnapprovedProvider\",\n        \"remediationGuidance\": \"Assets discovered on unapproved providers should be removed from that provider or decommissioned immediately. If that is not an option, the compliance team at your organization should work to certify the provider so that your organization remains compliant. Consider exploring how the asset ended up being hosted with an unauthorized provider and develop processes to prevent future occurrences.\"\n    },\n    {\n        \"issueTypeId\": \"ASUSRouter\",\n        \"remediationGuidance\": \"It is recommended to evaluate whether or not this asset should be exposed to the internet.\\nIf it is determined that the device should not be publicly exposed, identify the asset owner and work with them to remove the device from being accessible to the internet.\"\n    },\n    {\n        \"issueTypeId\": \"AtlassianBitbucket\",\n        \"remediationGuidance\": \"Bitbucket is known to have been https://jira.atlassian.com/browse/BSERV-13438 with attackers being able to perform remote code execution. Xpanse recommends Bitbucket deployments are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\"\n    },\n    {\n        \"issueTypeId\": \"AtlassianCrucible\",\n        \"remediationGuidance\": \"Determine whether this asset should be exposed to the public internet or not.\\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"AtlassianFisheye\",\n        \"remediationGuidance\": \"Determine whether this asset should be exposed to the public internet or not.\\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"AtlassianJiraServer\",\n        \"remediationGuidance\": \"Evaluate whether the JIRA Server must be accessible on the public internet. JIRA servers that contain sensitive information should remain on internal networks. If a JIRA server must be publicly available, adhere to the following best practices:\\n\\n1. Require all accounts to use MFA.\\n2. Refuse anonymous user access. This will require all users to be logged in to view data.\\n3. Take a least privilege approach when determining which access different user groups should have.\\n4. Stay up to date with the latest Attlasian Security Advisories: https://confluence.atlassian.com/jira/security-advisories-112853939.html\"\n    },\n    {\n        \"issueTypeId\": \"AtlassianJiraServiceManagement\",\n        \"remediationGuidance\": \"If you have discovered an exposed and vulnerable instance of Jira Service Management, you should take the following steps to remediate the vulnerability:\\n\\n1. Quarantine the vulnerable server/application to prevent further potential exploits, lateral movement, data loss, or footholds in your environment.\\n2. Identify the specific vulnerability affecting the instance of Jira Service Management.\\n3. Once you have identified the vulnerability, apply any available patches or updates to the instance of Jira Service Management to remediate the vulnerability.\\n4. Ensure that the instance of Jira Service Management is configured with appropriate security settings, such as SSL encryption, two-factor authentication, and access controls.\\n5. Review logs associated with the device to include network logs, application logs, IPS/IDS logs, EDR logs, OS logs, etc. to determine if any compromise as a result of the vulnerable asset took place. Then contain, eradicate, and remediate appropriately.\\n6. Continue to monitor all instances of Jira Service Management for future vulnerabilities and apply patches and updates as necessary to ensure ongoing proficient security.\"\n    },\n    {\n        \"issueTypeId\": \"AvePointFly\",\n        \"remediationGuidance\": \"Successful exploitation of AvePoint Fly servers could give malicious actors access to PII data or sensitive details about critical infrastructure that may be used as leverage in more sophisticated attacks.\\n\\nXpanse recommends minimizing network exposures for AvePoint Fly servers by ensuring they are not publicly exposed on the internet and are only accessible through a VPN if remote access is required.\"\n    },\n    {\n        \"issueTypeId\": \"BarracudaEmailSecurityGateway\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Barracuda Email Security Gateway they can potentially intercept, read, and modify emails, bypass security filters, inject malware or phishing links, steal sensitive data, disrupt email services, and compromise the organization&#39;s overall email security and communication integrity. \\n\\nTo remediate devices affected by CVE-2023-2868, the vendor recommends that impacted ESG appliances must be immediately replaced regardless of patch version level.\\nFor information regarding CVE-2023-2868, please refer to the following resources:\\n1. https://www.barracuda.com/company/legal/esg-vulnerability\\n2. https://status.barracuda.com/incidents/34kx82j5n4q9\\n3. https://nvd.nist.gov/vuln/detail/CVE-2023-2868\\n\\nFor security recommendations that do not involve CVE-2023-2868, it is recommended to perform the following:\\n1. Implement network access controls and firewall rules to limit access to the Barracuda Email Security Gateway only to authorized IP addresses and users.\\n2. Regularly update the firmware and software of the Barracuda Email Security Gateway to ensure it has the latest security patches and protection against known vulnerabilities.\\n3. Enable multi-factor authentication (MFA) and enforce strong, unique passwords for all user accounts accessing the gateway.\\n4. Continuously monitor the gateway for any suspicious activity, and enable logging to detect and analyze potential security incidents.\\n5. Periodically review and validate the gateway&#39;s security configurations, ensuring they adhere to the organization&#39;s security policies and industry best practices.\"\n    },\n    {\n        \"issueTypeId\": \"BlueimpjQueryFileUpload\",\n        \"remediationGuidance\": \"Blueimp jQuery File Upload is highly insecure and vulnerable to unrestricted file upload vulnerabilities like **CVE-2018-9206**. Successful exploitation could lead to attackers performing remote code execution through malicious file uploads.\\n\\nDue to the ease of exploitation and the widget being officially end-of-life, no configuration of jQuery File Upload is considered safe. Xpanse recommends removing this widget from your organization\u2019s websites.\"\n    },\n    {\n        \"issueTypeId\": \"Bod1801NonCompliantWebServer\",\n        \"remediationGuidance\": \"1. Best practice is to remove support for known-weak cryptographic protocols and ciphers.\\n2. Evaluate if there is any PII or sensitive information on the web server to understand the impact. Identify all versions of SSL/TLS and corresponding ciphers.\\n3. Follow the guidance set forth by CISA to ensure weak protocols and ciphers have been updated to the approved versions.  https://www.cisa.gov/binding-operational-directive-18-01\"\n    },\n    {\n        \"issueTypeId\": \"Bod1801NonCompliantWebServerInsecureTLSCipher\",\n        \"remediationGuidance\": \"The weak or disallowed algorithms flagged by this policy are easily exploitable, and supporting them could lead to sensitive data leaks. These cipher suites should be disabled in favor of cryptographic algorithms that are considered secure, like SHA256, SHA384, SHA512, and ECDSA.\"\n    },\n    {\n        \"issueTypeId\": \"Bod1801NonCompliantWebServerInsecureTLSVersion\",\n        \"remediationGuidance\": \"The SSL/TLS versions flagged by this policy are famously insecure and increasingly less supported by modern browsers. The exploitation of these protocols could lead to attacks such as Padding Oracle On Downgraded Legacy Encryption (POODLE), Browser Exploit Against SSL/TLS (BEAST), and Compression Ratio Info-leak Made Easy (CRIME), which could lead to critical data leaks.\\n\\nComplying with BOD 18-01 directives requires disabling TLS 1.0, SSL 2.0, and SSL 3.0.\"\n    },\n    {\n        \"issueTypeId\": \"Bod1801NonCompliantWebServerInvalidHSTS\",\n        \"remediationGuidance\": \"When STS is not configured, threat actors can run SSL stripping attacks, making all web connections unencrypted. It is recommended to enable HTTP Strict Transport Security (HSTS) by following these steps:\\n\\n1. Add a Strict-Transport-Security response header to your application with the value: max-age&#61;31536000. This will inform the browser that it should not allow that web application to be accessed over HTTP during the configured time. The max age should be set to at least one year.\\n2. Add the includeSubDomains flag, which will enforce HSTS at the subdomain level.\\n3. Consider submitting your application\u2019s domain to preload lists. Preloading is not a hard requirement, but preloading will prevent SSL stripping attacks on first use. Preloading may not be a feasible solution if any subdomains are expected to function over HTTP, as it will make those subdomains inaccessible.\\n\\nFurther documentation: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html.\"\n    },\n    {\n        \"issueTypeId\": \"BoxStorage\",\n        \"remediationGuidance\": \"Instances of Box Storage that are unpatched or misconfigured pose a serious security risk to your organization.\\n\\nEnsure you are running the latest version and use security best practices to restrict access to the application.\\n\\nBest practices include, but are not limited to:\\n* Utilizing MFA\\n* Placing access to the application behind security devices\\n* Monitoring for nefarious activity targeting Box Storage\\n\\nBox Storage does not currently have any registered CVEs, but security researchers have discovered security flaws in the software including the ability to bypass MFA.\"\n    },\n    {\n        \"issueTypeId\": \"BuildingControlSystem\",\n        \"remediationGuidance\": \"Successful attacks against building control systems could significantly impact human health and safety and could lead to infrastructure and environmental damage. These types of breaches usually happen when building control systems are publicly exposed and don\u2019t have robust authentication, encryption, and access controls in place, either due to a lack of proper configuration, legacy protocols, or end-of-life versions that do not provide sufficient security features.\\n\\nXpanse recommends securing assets surfaced by this policy by performing the following:\\n\\n1. Minimize network exposure by deploying building control systems behind a firewall and ensure they are not accessible from the public internet. Block unauthorized traffic and regularly monitor network traffic.\\n2. When remote access is required, further limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system and that access is granted on a need-to-know basis to mitigate the risk of insider threats.\\n3. All building control sub-systems\u2019 networks should be segregated from one another to prevent an intruder from traversing the networking and gaining full infrastructure access.\\n4. Implement multi-factor authentication to prevent unauthorized access and enforce robust password policies.\\n5. Keep all software employed by building control systems up to date by regularly applying patches and updates to address known vulnerabilities.\"\n    },\n    {\n        \"issueTypeId\": \"CactiNetworkMonitoringTool\",\n        \"remediationGuidance\": \"Since this tool allows access to logs for various devices, it is recommended to have this interface only available to the internal network and not be internet facing. \\n1. Identify the device / asset owner and discuss whether there is a business need for the interface to be internet facing.\\n2. If it is determined that the device must be internet facing due to business requirements, ensure it is placed behind security tooling such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled.\"\n    },\n    {\n        \"issueTypeId\": \"CentOSWebPanel\",\n        \"remediationGuidance\": \"CentOS Web Panel (CWP) is frequently vulnerable to remote code execution attacks, the most recent example being https://nvd.nist.gov/vuln/detail/CVE-2022-44877, so staying up-to-date on patching is critical.\\n\\nXpanse recommends reviewing the results surfaced by this policy to determine whether your organization is running a version of CWP before 0.9.8.1147. Since https://nvd.nist.gov/vuln/detail/CVE-2022-44877 does not require a sophisticated attack, and it is currently exploited in the wild, it is imperative to update CWP to the latest version.\\n\\nThe default installation of CWP comes with automatic patching, and, if possible, it is strongly encouraged that this functionality is enabled at all times. CWP is known for quickly addressing security vulnerabilities, and automatic security updates are published often before public vulnerability disclosure, so using this feature is essential in securing your environment.\"\n    },\n    {\n        \"issueTypeId\": \"CertificateFromUnapprovedIssuer\",\n        \"remediationGuidance\": \"Certificates discovered from unapproved issuers should be revoked from your SSL domain immediately. Consider exploring how the certificate was issued from an unauthorized issuer and develop processes to prevent future occurrences. To request a new certificate you will need to generate a Certificate Signing Request, submit it to an authorized issuer, and then install the certificate on your domain.\"\n    },\n    {\n        \"issueTypeId\": \"CertificateInCertificateChainExpiringSoon\",\n        \"remediationGuidance\": \"Expired certificates can lead to catastrophic errors. Most browsers will display warnings if a user attempts to access a website with expired certificates. Certain programs and APIs will throw errors if they try interfacing with websites with expired certificates.\\n\\nIt is recommended to work with the asset owner to renew the expired certificate(s) and implement a strategy to prevent expiry in the future.\"\n    },\n    {\n        \"issueTypeId\": \"CertificateNameMismatch\",\n        \"remediationGuidance\": \"A certificate name mismatch indicates that the website a user is visiting may be fraudulent. In order to ensure access to the service, update the subject alternative names to include the correct domain name.\\n\\nCertain browsers such as https://developer.chrome.com/blog/chrome-58-deprecations/#remove-support-for-commonname-matching-in-certificates no longer check the common name field, so only updating the common name may still cause errors. Details on certificate naming standards can be found in https://datatracker.ietf.org/doc/html/rfc2818#section-3.1.\"\n    },\n    {\n        \"issueTypeId\": \"CheckboxSurvey\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Checkbox Survey server they can potentially manipulate and compromise sensitive data including survey responses, user information, and survey designs. The attacker may also disrupt the survey process by altering or deleting surveys, impersonating legitimate users, and launching further attacks against connected systems. This could lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization using the Checkbox Survey server.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the Checkbox Survey server from the public internet by placing it behind a firewall, allowing only necessary traffic to reach the server through network segmentation.\\n2. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to restrict access to the server only to authorized personnel.\\n3. Ensure that the Checkbox Survey software and underlying server components are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n4. Enable encryption for data transmission (e.g., HTTPS) and storage (e.g., database encryption) to protect sensitive data from unauthorized access and tampering.\\n5. Employ monitoring and intrusion detection tools to identify and respond to any suspicious activities or potential security breaches on the Checkbox Survey server. Regularly review access logs and server configurations to ensure security best practices are being followed.\"\n    },\n    {\n        \"issueTypeId\": \"CircleCI\",\n        \"remediationGuidance\": \"An unpatched and misconfigured instance of CircleCI poses a serious security risk to any organization.\\n\\n1. If your organization&#39;s CircleCI instance must be public facing due to remote developers or admins place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\\n2. Another method that can offer secure access to assets on prem would to utilize a VPN to offer remote access.\\n3. Ensure monitoring is configured to detect activities such as unauthorized access or exploit attempts.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoAdaptiveSecurityAppliance\",\n        \"remediationGuidance\": \"Unpatched or misconfigured Cisco ASA devices pose a serious security risk due to 115&#43; public CVEs associated with the devices. The CVEs cover a large number of issues such as remote code execution, DoS, and authentication bypasses.\\n\\n1. Ensure your organization is running the latest updates for your Cisco ASAs to prevent known/active exploits from being successfully ran against your devices.\\n2. Never place admin logins for devices on a public facing asset.\\n3. Enable robust application and server logging to monitor for nefarious activities.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoDuoSSO\",\n        \"remediationGuidance\": \"Cisco Duo SSO is known to be vulnerable to sophisticated attacks from known threat actors. Xpanse recommends following the mitigation measures outlined in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoFirepowerDevice\",\n        \"remediationGuidance\": \"Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\\n\\nXpanse recommends performing the following steps to keep firewall devices secure:\\n\\n1. Ensure the firewall\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoIOS\",\n        \"remediationGuidance\": \"Cisco IOS is particularly vulnerable to Denial of Service (DOS)  attacks due to insufficient resource management vulnerabilities, like https://nvd.nist.gov/vuln/detail/CVE-2022-20697. Cisco IOS is primarily vulnerable when the web administrative interface is publicly exposed, and it is strongly recommended to make the web UI publicly inaccessible as soon as possible.\\n\\nSince Cisco IOS runs on routers and switches, Xpanse recommends performing the following steps on these devices to remain secure:\\n\\n1. Ensure the device\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the device\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the device behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoIOSXE\",\n        \"remediationGuidance\": \"Cisco IOS XE is particularly vulnerable to Denial of Service (DOS)  attacks due to insufficient resource management vulnerabilities, like https://nvd.nist.gov/vuln/detail/CVE-2022-20697. Cisco IOS XE is primarily vulnerable when the web administrative interface is publicly exposed, and it is strongly recommended to make the web UI publicly inaccessible as soon as possible.\\n\\nSince Cisco IOS XE runs on routers and switches, Xpanse recommends performing the following steps on these devices to remain secure:\\n\\n1. Ensure the device\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the device\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the device behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoSecureAccessControlSystem\",\n        \"remediationGuidance\": \"If for any reason it is determined that this device should not be publicly exposed to the internet, identify the asset owner and work to restrict access to the device.\\nOrganizations should follow Cisco&#39;s security best practices and ensure instances are up to date and configured securely.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoSmallBusinessRVSeriesRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoSmartInstall\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Cisco Smart Install service, they can potentially exploit vulnerabilities and perform various malicious actions. These actions include gaining unauthorized access to the switch configuration, which may expose sensitive information like passwords, IP addresses, and network topology. Additionally, they can modify the switch configuration, potentially leading to network disruption or creating backdoors for future access. Attackers can also upload and execute malicious IOS images, compromising the switch and allowing them to gain full control over the device.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Disable Cisco Smart Install if the service is not required by issuing the &#34;no vstack&#34; or &#34;no vstack config&#34; command in global configuration mode on the affected switches, preventing unauthorized access to the service. If the switch or router meets certain conditions however, it may need to be disabled via ACL. More information can be found on a Cisco community post https://community.cisco.com/t5/switching/cisco-smart-install-no-vstack-command/td-p/3363773.\\n2. Implement strict network segmentation to isolate devices running Cisco Smart Install from the rest of the network, limiting potential attack surfaces and helping contain any threats that may exploit the service.\\n3. Configure Access Control Lists (ACLs) on the switches to restrict incoming traffic to the Cisco Smart Install service, allowing access only from trusted IP addresses or management networks.\\n4. Continuously monitor and log activities related to the Cisco Smart Install service, looking for any suspicious behavior or unauthorized access attempts, which helps in early detection and remediation of potential threats.\\n5. Keep the Cisco IOS software up to date with the latest patches and security updates, ensuring that known vulnerabilities are addressed and reducing the chances of exploitation by attackers. Regularly review and follow Cisco&#39;s security advisories for any relevant updates.\\n\\nA helpful document released by the United States of America National Security Agency (NSA) describing how the protocol can be misused (as well as some helpful guidance on remediation) can be found https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoUnifiedIPPhones\",\n        \"remediationGuidance\": \"IP phones (VoIP telephones, SIP phones or soft phones) are designed for VoIP and use data network instead of the phone network. Organizations should follow security best practices and ensure such devices are configured securely, and only accessible to the public Internet if there is a legitimate business case.\"\n    },\n    {\n        \"issueTypeId\": \"CiscoWirelessLanController\",\n        \"remediationGuidance\": \"Cisco Wireless LAN Controller has many associated critical vulnerabilities, such as CVE-2022-20695 and CVE-2016-1363, an authentication bypass and buffer overflow vulnerability respectively.\\nTo remain protected, ensure that the server is running the latest secure version.\\nFor a list of vendor security advisories regarding Wireless LAN Controller, visit https://www.cisco.com/c/en/us/support/wireless/wireless-lan-controller-software/products-security-advisories-list.html.\"\n    },\n    {\n        \"issueTypeId\": \"CitrixApplicationDeliveryController\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Citrix ADC, they can potentially compromise the organization&#39;s security by manipulating traffic, accessing sensitive data, deploying malware, and disrupting application availability.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Implement strict firewall configurations to restrict unauthorized access.\\n2. Keep the Citrix ADC updated with the latest security patches.\\n3. Enforce multi-factor authentication for administrative access.\\n4. Regularly audit and adjust access control policies to maintain security.\\n\\nMore information on security best practices can be found https://docs.netscaler.com/en-us/citrix-adc-secure-deployment.html#network-security and other helpful information found https://support.citrix.com/article/CTX228148/how-to-lock-down-citrix-adc-management-interfaces-with-acls.\"\n    },\n    {\n        \"issueTypeId\": \"CitrixGateway\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Citrix Gateway, they can potentially compromise the organization&#39;s security by accessing sensitive data, deploying malware, and disrupting operations. This unauthorized access can lead to widespread damage, including data theft, service disruptions, and harm to the organization&#39;s reputation and financial stability.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Ensure proper firewall configurations to restrict unauthorized access.\\n2. Apply the latest security patches and updates.\\n3. Enforce multi-factor authentication.\\n4. Regularly review and adjust access control policies.\\n\\nMore information on security best practices can be found https://docs.netscaler.com/en-us/citrix-adc-secure-deployment.html#network-security.\"\n    },\n    {\n        \"issueTypeId\": \"CitrixShareFileServer\",\n        \"remediationGuidance\": \"There are a number of CVEs associated with Citrix ShareFile, such as CVE-2023-24489, a critical improper access control vulnerability. While ShareFile is expected to be accessible on the public internet, there are a number of steps that should be done to ensure the servers remain secure:\\n\\n1. Upgrade to the latest secure version. For CVE-2023-24489 specifically, upgrade the ShareFile storage zones controllers to version 5.11.24. Details on how to upgrade storage zone controllers can be found in the https://docs.sharefile.com/en-us/storage-zones-controller/5-0/upgrade.html.\\n2. If ShareFile is only used internally, consider placing the servers behind a VPN or implement access to approved devices.\\n3. Use encrypted protocols at all times when communicating with ShareFile servers.\\n4. Monitor for malicious traffic.\"\n    },\n    {\n        \"issueTypeId\": \"CitrixWorkspace\",\n        \"remediationGuidance\": \"To secure Citrix Workspace instances, it is recommended to perform the following:\\n\\n1. Isolate Citrix Workspace instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Citrix Workspace instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Citrix Workspace instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Citrix Workspace instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"CitrixXenMobileServer\",\n        \"remediationGuidance\": \"If attackers gain access to a publicly exposed Citrix XenMobile Server instance, an organization\u2019s communication infrastructure could be breached and it could lead to leaks of sensitive proprietary information or could lead to significant communication interruptions.\\n\\nTo secure Citrix XenMobile Server instances, it is recommended to perform the following:\\n\\n1. Isolate Citrix XenMobile Server instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Citrix XenMobile Server instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Citrix XenMobile Server instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Citrix XenMobile Server instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ClarioClinicalTrialManagementSystems\",\n        \"remediationGuidance\": \"1. Medical record systems should not be directly accessible from the internet as they pose a significant risk to exposing Protected Health Information (PHI).\\n\\n2. It is imperative to take a risk based approach considering legal and regulatory issues associated with having a medical record system exposed to the internet.\\n\\n3. Guidelines and regulatory policy regarding securing Electronic health Records (EHR) can be found https://www.hhs.gov/hipaa/index.html\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedAjpServer\",\n        \"remediationGuidance\": \"AJP Servers are not designed to be used over the Internet and should never be exposed publicly.\\nCo-located AJP Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the AJP server and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedCiscoSmartInstall\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Cisco Smart Install service, they can potentially exploit vulnerabilities and perform various malicious actions. These actions include gaining unauthorized access to the switch configuration, which may expose sensitive information like passwords, IP addresses, and network topology. Additionally, they can modify the switch configuration, potentially leading to network disruption or creating backdoors for future access. Attackers can also upload and execute malicious IOS images, compromising the switch and allowing them to gain full control over the device.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Disable Cisco Smart Install if the service is not required by issuing the &#34;no vstack&#34; or &#34;no vstack config&#34; command in global configuration mode on the affected switches, preventing unauthorized access to the service. If the switch or router meets certain conditions however, it may need to be disabled via ACL. More information can be found on a Cisco community post https://community.cisco.com/t5/switching/cisco-smart-install-no-vstack-command/td-p/3363773.\\n2. Implement strict network segmentation to isolate devices running Cisco Smart Install from the rest of the network, limiting potential attack surfaces and helping contain any threats that may exploit the service.\\n3. Configure Access Control Lists (ACLs) on the switches to restrict incoming traffic to the Cisco Smart Install service, allowing access only from trusted IP addresses or management networks.\\n4. Continuously monitor and log activities related to the Cisco Smart Install service, looking for any suspicious behavior or unauthorized access attempts, which helps in early detection and remediation of potential threats.\\n5. Keep the Cisco IOS software up to date with the latest patches and security updates, ensuring that known vulnerabilities are addressed and reducing the chances of exploitation by attackers. Regularly review and follow Cisco&#39;s security advisories for any relevant updates.\\n\\nA helpful document released by the United States of America National Security Agency (NSA) describing how the protocol can be misused (as well as some helpful guidance on remediation) can be found https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF.\\n\\nCo-located Cisco Smart Install Service issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Cisco Smart Install service and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedDNP3\",\n        \"remediationGuidance\": \"Co-located DNP3 issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the DNP3 service and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n\\nIf an attacker is able to exploit DNP3 they could potentially disrupt or manipulate the operation of a SCADA system. This could lead to various consequences, depending on the industry and application of the system. This can include anything from causing power outages by controlling electrical systems to altering the readings of sensors in water treatment plants to disrupt the treatment process.\\n\\nIt is recommended to perform the following:\\n1. Identify the exposed DNP3 service and assess the extent of the exposure.\\n2. Disable or block the exposed service from public access.\\n3. Verify that the latest version of DNP3 protocol is being used and update if necessary.\\n4. Check for any known vulnerabilities and apply relevant patches or updates.\\n5. Review the DNP3 configuration settings and ensure that security best practices are being followed, such as using strong passwords and limiting access to authorized personnel only.\\n\\nDocumentation regarding the DNP3 protocol can be found at the DNP website https://www.dnp.org/Resources/Public-Documents.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedElasticsearchServer\",\n        \"remediationGuidance\": \"1. Elasticsearch servers should never be accessible from the Internet as they are not security hardened and regularly have exploits released for them.\\n2. Co-located Elasticsearch server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Elasticsearch servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Elasticsearch server to ensure it is no longer leveraging co-located settings.\\n4. Security best practices can be followed from Elastic https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-stack-security.html\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMemcachedServer\",\n        \"remediationGuidance\": \"A co-located Memcached server poses significant risk as Memcached systems may contain sensitive information and should not be externally accessible as they are not hardened against external attacks.\\n1. Identify the exposed Memcached server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located Memcached server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Memcached servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Memcached systems to ensure it is no longer leveraging co-located settings.\\n4. It is recommended to bind Memcached to a local interface and Disable UDP on the Memcached system (Disabling TCP on the public interface is also recommended but can cause issues with accessing resources outside of the internal network).\\n5. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMicrosoftDnsServer\",\n        \"remediationGuidance\": \"1. Unpatched and misconfigured Microsoft DNS Servers pose a serious security risk to any organization as severe vulnerabilities have been recently released including remote code execution (RCE).\\n2. Co-located Microsoft DNS Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Microsoft DNS Servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Microsoft DNS Server to ensure it is no longer leveraging co-located settings.\\n4. Microsoft has a free training module around securing Windows Server DNS that can be found https://learn.microsoft.com/en-us/training/modules/secure-windows-server-domain-name-system/\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMongoServer\",\n        \"remediationGuidance\": \"MongoDB servers and database servers in general should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\\n\\n1. Identify the exposed MongoDB server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located MongoDB server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the MongoDB servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the MongoDB server to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. MongoDB server security best practices can be followed https://www.mongodb.com/docs/manual/administration/security-checklist/.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMoxa\",\n        \"remediationGuidance\": \"Co-located Moxa issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Moxa device and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n\\nIf an attacker gains access to a Moxa device, they could potentially compromise the security and integrity of the SCADA system and the connected industrial processes.\\n\\nIt is recommended to perform the following:\\n1. Identify the exposed Moxa device\\n2. Secure the device by changing the default password, disabling unnecessary services or features, and updating the firmware\\n3. Review the device configuration and implement security best practices\\n4. Implement network segmentation to isolate the Moxa device\\n5. Monitor the device for any suspicious activity or attempted attacks\\n\\nAfter identifying the specific Moxa device, it is also recommended to consult the documentation for the product which can be found https://www.moxa.com/en/support/product-support/software-and-documentation.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMssqlServer\",\n        \"remediationGuidance\": \"MSSQL servers (or SQL servers of any kind) should not be publicly accessible over the Internet as they regularly contain sensitive enterprise information and are not hardened to the same security standards as systems designed to be publicly accessible, putting them at risk of compromise.\\n\\n1. Co-located MSSQL server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory.\\n2. Due to the potential for ephemerality and multi-tenancy it is important to identify the MSSQL servers and ensure they are removed.\\n3. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMulticastDnsServer\",\n        \"remediationGuidance\": \"Unpatched and misconfigured Colocated Multicast DNS (mDNS) Servers pose a serious security risk to any organization as mDNS servers are vulnerable to propagating data spills and DDoS related attacks.\\n\\n1. mDNS servers contain information or are capable of obtaining information about your network infrastructure to include hostnames, IP address, and other device information.\\nThis can lead to attackers gaining information about your network architecture and the devices that reside on your network.\\n2. mDNS servers can be leveraged for reflective/amplification DoS/DDoS attacks against your organization or other organizations. This is due to the nature of the way DNS/mDNS works. Specifically, mDNS servers are designed to send multicast requests to every host on the network they reside on which can lead to network degradation or outages on your network. Additionally, they can be used to respond to addresses making the request externally, therefore if the IP address were to be spoofed, they would likely reply to that IP instead of the actual requesting IP leading to a use for external DDoS/DoS.\\n3. Co-located mDNS server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the mDNS servers and ensure they are configured correctly.\\n4:Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the mDNS server to ensure it is no longer leveraging co-located settings.\\n5:It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n6. Ensure mDNS servers are not configured to be public facing or available via the internet.\\n7. mDNS servers can provide a quick, easy, under the radar method for attackers who have infiltrated your organization to map assets on the network. To provide detection for this ensure verbose logging is available and detections are built on these logs for anomalies such as a 30 day look-back for IP addresses first observed, high query counts, and other potentially nefarious indicators. To provide protection against this implement zero-trust on your mDNS server by allow-list implementation on your mDNS server or devices routing to the mDNS server.\\n8. Microsoft mDNS Server best practices can be followed here: https://techcommunity.microsoft.com/t5/networking-blog/mdns-in-the-enterprise/ba-p/3275777\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedMysqlServer\",\n        \"remediationGuidance\": \"MySQL servers (or SQL servers of any kind) should not be publicly accessible over the Internet as they regularly contain sensitive enterprise information and are not hardened to the same security standards as systems designed to be publicly accessible, putting them at risk of compromise.\\n\\n1. Co-located MySQL server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory.\\n2. Due to the potential for ephemerality and multi-tenancy it is important to identify the MySQL servers and ensure they are removed.\\n3. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedNetBiosNameServer\",\n        \"remediationGuidance\": \"NetBIOS name servers should never be exposed to the public internet as they leak information about users, hostnames, internal IP addresses, services, and operating systems on a local network, and are also not hardened to the same standard as systems designed to be public facing, putting them at risk for exploitation.\\n\\nBest practice is to not have NetBIOS be publicly accessible from the internet.\\n\\nCo-located NetBIOS name server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the NetBIOS name servers and ensure they are configured correctly. It is also recommended to reach out to the applicable cloud service provider for any other recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedOPCUA\",\n        \"remediationGuidance\": \"Co-located OPC UA issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the OPC UA server and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n\\nIf an attacker were to gain access to an OPC UA Discovery Server, they could potentially discover all the OPC UA enabled devices and applications in the network. This information could be used to launch targeted attacks against these devices or applications, potentially leading to unauthorized access, data theft, or even physical damage to industrial processes.\\n\\nIt is recommended to perform the following:\\n1. Identify and document all devices and applications that are exposed by the Discovery Server.\\n2. Verify that the Discovery Server is properly configured and secured, and that it&#39;s only accessible to authorized personnel.\\n3. Patch any known vulnerabilities on the Discovery Server and all exposed devices and applications.\\n4. Implement strong access controls, including multi-factor authentication and role-based access control, to restrict access to the Discovery Server and all exposed devices and applications.\\n5. Monitor the Discovery Server and all exposed devices and applications for any suspicious activity, using intrusion detection systems and security information and event management (SIEM) tools.\\n\\nDocumentation on OPC UA can be found on the OPC Foundation&#39;s site https://reference.opcfoundation.org/\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedOpenBgpServer\",\n        \"remediationGuidance\": \"BGP servers are naturally exposed to the internet as they allow for routing between networks. BGP servers, if not properly secured, can result in malicious rerouting of internet traffic and eavesdropping.\\n\\n1. Identify the exposed BGP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located BGP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the BGP servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the BGP server to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. BGP server security best practices from the NSA can be followed https://www.nsa.gov/portals/75/documents/what-we-do/cybersecurity/professional-resources/ctr-guide-to-border-gateway-protocol-best-practices.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedPostgresServer\",\n        \"remediationGuidance\": \"Postgres servers and database servers in general should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\\n\\n1. Identify the exposed Postgres server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located Postgres server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Postgres servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Postgres server to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. Postgres server security best practices can be followed https://www.postgresql.org/docs/current/runtime.html\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedPptpServer\",\n        \"remediationGuidance\": \"Point-to-Point Tunneling Protocol (PPTP) is a VPN protocol that is widely considered obsolete and extremely insecure.\\nPPTP servers should be replaced with a modern VPN server immediately.\\n\\n1. Co-located PPTP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory.\\n2. Due to the potential for ephemerality and multi-tenancy it is important to identify the PPTP servers and ensure they are removed.\\n3. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedRdpServer\",\n        \"remediationGuidance\": \"Recommendations to reduce the likelihood of malicious RDP attempts are as follows:\\n\\n1. Best practice is to not have RDP publicly accessible on the internet.\\n2. Implement a risk-based approach that prioritizes patching RDP vulnerabilities that have known weaponized public exploits.\\n3. Limit RDP access to a specific user group.\\n4.  Implement lockout policies to protect against RDP brute-forcing.\\n5. Enable NLA (Network Level Authentication) which is non-default on older versions.\\n6. If remote access to RDP or terminal services is a business requirement, it should only be made accessible through a secure Virtual Private Network (VPN) connection with multi-factor authentication (MFA) to the corporate network or through a zero-trust remote access gateway.\\n\\nFor co-located issues, follow best practice security recommendations from the applicable cloud service provider.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedRedisServer\",\n        \"remediationGuidance\": \"Redis servers should never be publicly accessible over the internet as they contain no authentication mechanism and all data is stored in clear text.\\n\\n1. Identify the exposed Redis server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located Redis server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Redis servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Redis server to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. Redis server security best practices can be followed https://redis.io/docs/manual/security/.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedRpcBindServer\",\n        \"remediationGuidance\": \"Rpcbind servers can leak unnecessary information about the corporate environment. Due to this, it is recommended that they should not be exposed to the internet.\\nCo-located rpcbind server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the rpcbind server and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedRsyncServer\",\n        \"remediationGuidance\": \"Co-located Rsync servers should not be exposed to the internet as they may contain sensitive information especially since data exposure has become a prominent business risk to organizations.\\n\\n1. Identify the exposed Rsync server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located Rsync server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Rsync servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Rsync server to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. Rsync should be configured with hosts allow and hosts deny directives in order to follow least privilege principles.\\n6. Rysnc should then be setup to use the auth users directive which narrows the attack surface by user.\\n7. SSH should be leveraged for all Rysnc communication to allow for encryption.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedRtspServer\",\n        \"remediationGuidance\": \"Real Time Streaming Protocol (RTSP)(RFC2326) is an outdated and insecure protocol with multiple publicly available exploits. RTSP generally resides in embedded systems that are not intended to be exposed to the public internet.\\n\\n1. Identify the exposed RTSP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located RTSP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the RTSP servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the RTSP server to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. Check with the manufacture for security guidance and updates for any device containing the RTSP protocol.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedS7CommServer\",\n        \"remediationGuidance\": \"Co-located S7 Comm Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the S7 Comm server and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n\\nThe standard S7 communication protocol does not use secure communication methods and can be susceptible to session hijacking, denial of service (DoS) attacks, spoofing, and other attacks.\\n\\nA best practice is to make these types of devices accessible to trusted networks only. It is recommended that users protect network access with appropriate mechanisms such as firewalls, segmentation, VPN, etc. In addition to that, organizations should password-protect S7 comms and disallow client connections.\\n\\nPlease follow vendor guidance to configure the operational environment as described in https://www.siemens.com/cert/operational-guidelines-industrial-security.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedSipServer\",\n        \"remediationGuidance\": \"1. Co-located Session Initiation Protocol (SIP) issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the SIP devices and ensure they are configured correctly.\\n2. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the SIP device to ensure it is no longer configured with co-located settings.\\n3. Maintain SIP systems behind a firewall or through a VPN.\\n4. If your organization&#39;s SIP server needs to be exposed to the internet, then using high-entropy passwords, lockout policy, and traffic inspection is recommended.\\n5. Ensure that usernames are not based on extensions since most brute force attacks will attempt an extension match.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedSLP\",\n        \"remediationGuidance\": \"A co-located server utilizing SLP poses a significant risk as exposing SLP publicly would likely allow for an attacker to obtain information about services running on that particular server allowing for them to craft more effective direct attacks. Additionally, it is worth mentioning that this service is sometimes bundled into software as a part of tool\u2019s service discovery functionality which can have detrimental security impacts should the service be available beyond your LAN. An example of this would be the ransomware attacks against VMware ESXi in February of 2023. \\n\\n1. Contact the co-located server\u2019s administration team and ask that they remove the SLP service on the server from public access as having this service active poses a risk to your service on that system. \\n2. If your team administers the server, close port 427 and do not allow traffic to egress from that host. Review logs to determine if any suspicious activity can be identified from traffic outbound on this port in your network (e.g., suspicious external IPs connecting to SLP, large amounts of egress traffic, anomalous packet data, etc.)\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedSmbServer\",\n        \"remediationGuidance\": \"Co-located Server Message Block (SMB) servers should never be exposed to the internet as they are frequently targeted in cyber-attacks.\\n\\n1. Identify the exposed Server Message Block (SMB) server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located SMB server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the SMB servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the SMB server to ensure it is no longer leveraging co-located settings.\\n4. Secure the network perimeter by blocking connections to all versions of SMB for TCP ports 445 and 139 and UDP ports 137 and 138.\\n5. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n6. SMB server security best practices can be followed https://www.cisa.gov/uscert/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedSnmpServer\",\n        \"remediationGuidance\": \"Co-located Simple Network Management Protocol (SNMP) servers should never be exposed to the internet as they are a frequent target of cyber-attacks.\\n\\n1. SNMPv1 and SNMPv2 are inherently vulnerable due to not supporting any encryption options. It is strongly recommended always to use SNMPv3 whenever possible.\\n2. Co-located SNMP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy, it is essential to identify the SNMP servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the SNMP server to ensure it is no longer leveraging co-located settings.\\n4. Secure the network perimeter by blocking connections to all versions of SNMP for UDP ports 161 and 162.\\n5. It is also recommended to reach out to the applicable cloud service provider for further mitigation recommendations.\\n\\nFor more detailed guidelines, please review https://www.cisa.gov/uscert/ncas/alerts/TA17-156A.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedTelnetServer\",\n        \"remediationGuidance\": \"A co-located Telnet server poses significant risk as Telnet should never be exposed to the internet and, where possible, should be replaced with Secure Shell (SSH)\\n\\n1. Identify the exposed Telnet server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located Telnet server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the Telnet servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the Telnet systems to ensure it is no longer leveraging co-located settings.\\n4. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\\n5. Where possible, replace existing Telnet usage with SSH. If this is not feasible follow recommended guidelines set forth by the manufacturer to mitigate Telnet exposure.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedTftpServer\",\n        \"remediationGuidance\": \"In most cases, TFTP should not be used because it provides no built in security or authentication mechanisms. Therefore, the recommended course of action is to immediately remove TFTP from public access. Consider implementing a more secure file transfer protocol, such as FTPS or SFTP.\\n\\nhttps://datatracker.ietf.org/doc/html/rfc7440#section-7 details security risks associated with TFTP and possible workarounds.\\n\\nCo-located TFTP Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the TFTP server and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedUnencryptedFtpServer\",\n        \"remediationGuidance\": \"Unencrypted File Transfer Protocol (FTP) servers should never be accessible from the internet as they are not security hardened and regularly have exploits released for them.\\nCo-located FTP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the FTP servers and ensure they are configured correctly.\\n1. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the FTP server to ensure it is no longer leveraging co-located settings.\\n2. Evaluate if there is any PII or sensitive information on the server to understand the impact of the FTP Server transmitting unencrypted information.\\n3. Xpanse recommends reconfiguring the server to only accept encrypted FTPS connections or decommissioning the FTP Server and switching to a more modern secured and encrypted file transfer technology.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedUpnpServer\",\n        \"remediationGuidance\": \"The Universal Plug and Play (UPnP) protocol allows devices to export services and should not be directly accessible from the internet. There are multiple known vulnerabilities with public exploits available for UPnP libraries.\\n\\n1. Identify the exposed UPnP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Co-located UPnP server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the UPnP servers and ensure they are configured correctly.\\n3. Identify the IP address, certificate, and domain that is allowing co-location to occur. Configure the UPnP server to ensure it is no longer leveraging co-located settings.\\n4. Secure the network perimeter by blocking connections to all versions of UPnP for UDP port 1900.\\n5. It is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedVncServer\",\n        \"remediationGuidance\": \"VNC servers should not be directly exposed to the internet as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. The following should be evaluated and performed:\\n\\n1. Disable or remove the service from the internet.\\n2. Review whether VNC is absolutely necessary and see if tunneling VNC over SSH or a VPN can be utilized instead.\\n3. Use VNC implementations that encrypt the entire VNC session, including password authentication and data transfer.\\n\\nFor colocated issues, follow best practice security recommendations from the applicable cloud service provider.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedWinRM\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed WinRM service, they can potentially execute arbitrary commands on the target system, access sensitive information, manipulate system configurations, and move laterally within the network. This can lead to unauthorized access, data breaches, and loss of control over the affected machines, severely compromising the security of the environment.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Disabling WinRM when not required is a crucial step in preventing unauthorized access.\\n2. Configuring firewall rules to limit inbound access to the WinRM service only from trusted IP addresses or subnets can help reduce the attack surface.\\n3. Implementing strong authentication methods, such as Kerberos or certificate-based authentication, ensures only authorized users can access WinRM. It is important to avoid using Basic or NTLM authentication, as they are less secure.\\n4. Enabling encryption for data transmitted between the client and server by enforcing HTTPS instead of HTTP for WinRM communication is essential. This can be achieved by configuring the WinRM listener to use an SSL certificate.\\n5. Regularly auditing and monitoring WinRM logs and settings to detect unauthorized access attempts, configuration changes, or other suspicious activities is necessary. It is also important to implement monitoring tools to proactively identify and respond to security threats.\\n\\nCo-located WinRM Server issues are derived from the same cloud IP address of a known certificate or domain in your asset inventory. Due to the potential for ephemerality and multi-tenancy it is important to identify the WinRM server and ensure it is configured correctly.\\nIt is also recommended to reach out to the applicable cloud service provider for further security / mitigation recommendations.\"\n    },\n    {\n        \"issueTypeId\": \"ColocatedXmppServer\",\n        \"remediationGuidance\": \"XMPP servers should not be accessible on the public internet.  If an attacker gains access to an XMPP server, they could view the company structure, perform service discovery, and read messages with confidential information. If an XMPP server must be accessible on the public internet, ensure that:\\n1. The server is running with a server certificate.\\n2. The server is configured to not allow any cleartext client-to-server or server-to-server communications.\\n3. The server supports XEP-0198 and XEP-0124 protocol extensions.\\n4. Action is taken to prevent denial of service attacks, such as limiting the amount of connections from a single client.\\n\\nFor co-located issues, follow best practice security recommendations from the applicable cloud service provider.\"\n    },\n    {\n        \"issueTypeId\": \"CouchDBServer\",\n        \"remediationGuidance\": \"It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\\n\\nXpanse recommends securing your database software by taking the following steps:\\n\\n1. Isolate the database from the public internet by placing it behind a VPN.\\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"CrestronAirMedia\",\n        \"remediationGuidance\": \"The Crestron AirMedia line of products has associated CVEs, such as CVE-2019-3929, a critical command injection vulnerability. To secure this device, consider the following:\\n\\n1. Evaluate whether this Crestron AirMedia device must be accessible on the public internet. If this device is exclusively used inside your organization, consider placing the device inside an internal network.\\n2. Upgrade to the latest secure version.\\n3. Monitor for vendor https://www.crestron.com/Security/Security-Advisories-All.\"\n    },\n    {\n        \"issueTypeId\": \"DahuaCameras\",\n        \"remediationGuidance\": \"If an attacker compromises an exposed Dahua security camera, they can gain unauthorized access to live feeds, manipulate camera settings, record and store footage, use the camera as a pivot point for further network attacks, and potentially compromise the privacy and security of individuals and assets being monitored.\\n\\nIt is recommended to perform the following in order to remain secure:\\n1. Change the default username and password to prevent unauthorized access using publicly available credentials. \\n2. Update the camera&#39;s firmware regularly to fix known vulnerabilities and enhance security. \\n3. Configure network security settings (such as VLANs, firewalls, and encryption) to isolate the camera from the main network and protect it from unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"DataStorageAndAnalysis\",\n        \"remediationGuidance\": \"Data storage devices, such as network attached storage servers, often contain highly confidential data and should not be exposed to the public internet.\\n1. It is recommended to identify the asset and work to remove it from being accessible from the internet and instead allow access via a VPN.\\n2. If the asset needs to be exposed to the internet for a business purpose, it is recommended to place the device behind a Firewall or Web Application Firewall (WAF) with proper alerting and logging configured.\"\n    },\n    {\n        \"issueTypeId\": \"DefaultApacheTomcatPage\",\n        \"remediationGuidance\": \"Compromise of a Tomcat landing page could allow an adversary to connect to the management portal, change the configuration, upload new applications, or run arbitrary code on the server. It is recommended to edit &#34;httpd.conf&#34; to display a custom page or removing the file entirely, which will display HTTP 404 error instead of the Tomcat homepage.\"\n    },\n    {\n        \"issueTypeId\": \"DevelopmentEnvironment\",\n        \"remediationGuidance\": \"With some exceptions, development environments should not be accessible on the public internet. Development environments tend to be less stable and secure than production environments. If a development environment must be publicly accessible, follow these best practices:\\n\\n1. Utilize MFA on development and user test accounts.\\n2. Ensure external libraries and frameworks are up-to-date with the latest security patches.\\n3. Log and monitor traffic coming to and from the development environment.\\n4. Carefully track access to secret keys and credentials.\"\n    },\n    {\n        \"issueTypeId\": \"DjangoAdminPage\",\n        \"remediationGuidance\": \"When left unpatched or misconfigured, applications written in Django pose a serious security risk due to the 90&#43; public CVEs associated with this framework.\\n\\n1. Ensure your organization is running the latest version of Django to prevent known/active exploits from being successfully ran against your web applications.\\n2. Never place admin logins for applications on a public facing asset or, if necessary, do not make the accessible from the internet.\\n3. Ensure best practices are being followed for input sanitation to prevent successful injection attacks.\\n4. Enable robust application and server logging to monitor for nefarious activities such as XSS, fuzzing, port/host discovery scanning, vulnerability scanning, SQL injection, file inclusion attacks, brute force activities, and cross-site request forgery.\\n5. Place your web applications behind network security devices on your edge (such as WAFs) and enable monitoring on these devices along with DDoS mitigation functions.\"\n    },\n    {\n        \"issueTypeId\": \"DLinkDCS930L\",\n        \"remediationGuidance\": \"D-Link DCS-930L cameras are vulnerable to remote code execution and CSRF attacks (particularly notable: https://nvd.nist.gov/vuln/detail/CVE-2016-11021, https://nvd.nist.gov/vuln/detail/CVE-2019-10999, https://nvd.nist.gov/vuln/detail/CVE-2017-7852 and depending on network topology, they can serve as an entry point into your organization\u2019s network.\\n\\nXpanse recommends securing DCS-930L surveillance systems by taking the following steps:\\n\\n1. Ensure DCS-930L is on a separate network from your main network. This separation will prevent attackers who manage to break into the surveillance system from traversing into the main network, where more damage can be caused. The reverse can also happen, where attackers who manage to breach the main network can gain access to physical systems.\\n2. Do not publicly expose the DCS-930L surveillance server. If there is a strong business case for public exposure, then it is strongly recommended to place this server behind a https://www.paloaltonetworks.com/network-security/next-generation-firewall.\\n3. Make sure the camera OS is always up-to-date with the latest patches.\\n4. Enforce complex passwords and do not allow reusable passwords (which is a common attack vector)\\n5. Ensure all connections to the camera are SSL-encrypted.\"\n    },\n    {\n        \"issueTypeId\": \"DLinkDCSSeriesDevice\",\n        \"remediationGuidance\": \"D-Link DCS Series cameras are vulnerable to remote code execution and CSRF attacks (particularly notable: https://nvd.nist.gov/vuln/detail/CVE-2016-11021, https://nvd.nist.gov/vuln/detail/CVE-2019-10999, https://nvd.nist.gov/vuln/detail/CVE-2017-7852 and depending on network topology, they can serve as an entry point into your organization\u2019s network.\\n\\nXpanse recommends securing D-Link DCS Series surveillance systems by taking the following steps:\\n\\n1. Ensure the DCS device is on a separate network from your main network. This separation will prevent attackers who manage to break into the surveillance system from traversing into the main network, where more damage can be caused. The reverse can also happen, where attackers who manage to breach the main network can gain access to physical systems.\\n2. Do not publicly expose DCS devices. If there is a strong business case for public exposure, then it is strongly recommended to place this server behind a https://www.paloaltonetworks.com/network-security/next-generation-firewall.\\n3. Make sure the camera OS is always up-to-date with the latest patches.\\n4. Enforce complex passwords and do not allow reusable passwords (which is a common attack vector)\\n5. Ensure all connections to the camera are SSL-encrypted\"\n    },\n    {\n        \"issueTypeId\": \"DLinkDir300SeriesDevice\",\n        \"remediationGuidance\": \"Since this product is now considered End of Life (EoL), it is recommended to remove this device from being publicly accessible and look into a more up-to-date alternative.\\n\\nIf this device cannot be replaced, it is recommended to perform the following in order to remain secure:\\n1. Update the router&#39;s firmware by downloading and installing the latest version from the D-Link support website.\\n2. Replace the default username and password with strong, unique credentials.\\n3. Turn off remote management features to prevent unauthorized external network access.\\n4. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n5. Place the router behind appropriate security tooling such as a firewall.\"\n    },\n    {\n        \"issueTypeId\": \"DLinkDir610Device\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"DLinkDir800SeriesDevice\",\n        \"remediationGuidance\": \"If you have a D-Link DIR-800 Series router that has been exposed and is vulnerable, there are several steps you can take to remediate the issue:\\n\\n1. Disconnect the device from the network to prevent any potential further access or compromises. \\n2. Check the D-Link website for the latest firmware for your router and install it. The updated firmware should include patches for any known vulnerabilities.\\n3. Make sure to change the username and password for the router&#39;s administrative console. Choose a strong password that is not easily guessable.\\n4. If enabled, disable remote management of the router to prevent unauthorized access. This option is usually found in the router&#39;s administrative console.\\n5. Make sure that your wireless network is secured with WPA2 encryption. This will help prevent unauthorized access to your network.\\n6. Universal Plug and Play (UPnP) is a feature that can allow devices on your network to automatically open ports in your router&#39;s firewall, this should be disabled. This can create a security vulnerability, so it&#39;s a good idea to disable UPnP if you&#39;re not using it.\\n7. Use the router&#39;s administrative console to check for any unauthorized devices connected to your network.\"\n    },\n    {\n        \"issueTypeId\": \"DNP3\",\n        \"remediationGuidance\": \"If an attacker is able to exploit DNP3 they could potentially disrupt or manipulate the operation of a SCADA system. This could lead to various consequences, depending on the industry and application of the system. This can include anything from causing power outages by controlling electrical systems to altering the readings of sensors in water treatment plants to disrupt the treatment process.\\n\\nIt is recommended to perform the following:\\n1. Identify the exposed DNP3 service and assess the extent of the exposure.\\n2. Disable or block the exposed service from public access.\\n3. Verify that the latest version of DNP3 protocol is being used and update if necessary.\\n4. Check for any known vulnerabilities and apply relevant patches or updates.\\n5. Review the DNP3 configuration settings and ensure that security best practices are being followed, such as using strong passwords and limiting access to authorized personnel only.\\n\\nDocumentation regarding the DNP3 protocol can be found at the DNP website https://www.dnp.org/Resources/Public-Documents.\"\n    },\n    {\n        \"issueTypeId\": \"DockerRegistry\",\n        \"remediationGuidance\": \"A compromised Docker Registry server may provide an attacker with access to an organization&#39;s Docker images.\\nIt is recommended to evaluate whether this service should be exposed to the internet or not.\\nIf the service needs to be exposed to the internet for a business purpose, it is recommended to put the device behind security tooling such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled.\"\n    },\n    {\n        \"issueTypeId\": \"DomainControlValidatedCertificate\",\n        \"remediationGuidance\": \"While most browsers will accept domain control validated certificates, they are generally seen as a less-secure certificate due to lax identity verification. Domain control validated certificates are often used by cyber criminals to impersonate websites. Reputable websites should use trusted Certificate Authorities (CA) and opt for high-assurance validation methods, such as Extended Validation.\"\n    },\n    {\n        \"issueTypeId\": \"dotCMS\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed dotCMS server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization&#39;s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the dotCMS server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\\n2. Regularly update the dotCMS software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\\n5. Monitor the dotCMS server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices.\\n\\nMore information on secure configurations and best practices can be found https://www.dotcms.com/docs/latest/security-best-practices.\"\n    },\n    {\n        \"issueTypeId\": \"DotNetNukeCMS\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed DotNetNuke CMS server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization\u2019s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the DotNetNuke CMS server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\\n2. Regularly update the DotNetNuke CMS software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\\n5. Monitor the DotNetNuke CMS server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices.\"\n    },\n    {\n        \"issueTypeId\": \"DrayTekVigorRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"ElasticKibanaUserInterface\",\n        \"remediationGuidance\": \"To secure Elastic Kibana interfaces, it is recommended to perform the following:\\n\\n1. Isolate Elastic Kibana interfaces from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Elastic Kibana interfaces should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Elastic Kibana interfaces are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Elastic Kibana interfaces. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ElasticsearchServer\",\n        \"remediationGuidance\": \"It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\\n\\nXpanse recommends securing your database software by taking the following steps:\\n\\n1. Isolate the database from the public internet by placing it behind a VPN.\\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"EmbeddedSystem\",\n        \"remediationGuidance\": \"Embedded systems are frequently misconfigured and a common target of bad actors. Often embedded systems are not adequately secured, and depending on network topology, they can serve as an entry point into your organization\u2019s network.\\n\\nXpanse recommends securing embedded systems through these best practices:\\n\\n1. Ensure the system is separate from your main network. This separation will prevent attackers who manage to break into your embedded systems from traversing into the main network, where more damage can be caused. The reverse can also happen, where attackers who manage to breach the main network can gain access to physical systems.\\n2. Do not publicly expose embedded system servers. If there is a strong business case for public exposure, it is strongly recommended to place this server behind a firewall and restrict TCP/IP ports to critical ones.\\n3. Make sure the OS is always up-to-date with the latest patches.\\n4. Enforce robust authentication and do not allow weak or reusable passwords.\\n5. Do not use inherently insecure protocols like Telnet.\\n6. Ensure the system is secured at boot time by using cryptographically-signed boot images. The same approach applies to securing the system at execution time, which confirms that all running services are signed and prevent malware from running on the system.\\n\\nFor more detailed guidelines, please review https://www.cisa.gov/uscert/sites/default/files/ICSJWG-Archive/QNL_SEP_20/Protecting%20Embedded%20Systems%20-%20Verve%20Industrial_S508NC.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"EximMailTransferAgent\",\n        \"remediationGuidance\": \"To secure Exim Mail Transfer Agent instances, it is recommended to perform the following:\\n\\n1. Isolate Exim Mail Transfer Agent instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Exim Mail Transfer Agent instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Exim Mail Transfer Agent instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Exim Mail Transfer Agent instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ExpiredWhenScannedCertificate\",\n        \"remediationGuidance\": \"Expired certificates on active services are a good indication that a system may not be under active management. This can result in a lack of trust from external parties due to the web browser&#39;s warning for expired certificate.\\n1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \\n2. Identify all existing certificates and their expiration dates. For certificates that have expired follow established procedure to revoke and replace the certificate.\\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions. https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html\"\n    },\n    {\n        \"issueTypeId\": \"ExpiringCertificate\",\n        \"remediationGuidance\": \"Expired certificates and certificates about to expire on active services are a good indication that a system may not be under active management. This can result in a lack of trust from external parties due to the web browser&#39;s warning for expired certificate.\\n\\n1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \\n2. Identify all existing certificates and their expiration dates. For certificates that have expired or are about to expire follow established procedure to revoke and replace the certificate.\\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html.\"\n    },\n    {\n        \"issueTypeId\": \"ExpiringDomain\",\n        \"remediationGuidance\": \"Due to the fact that expired domains lead to significant security risks, certificates should be renewed prior to their expiry date.\"\n    },\n    {\n        \"issueTypeId\": \"ExposedDirectoryListing\",\n        \"remediationGuidance\": \"Directory listing is a web server feature that displays an index of all the resources in a website\u2019s directory. Malicious actors can use the critical information gained from exposed directory listings to discover vulnerabilities that could be exploited in your organization\u2019s environment. It is recommended to take the following steps to secure your environment:\\n\\n1. Disable directory listings in your web server\u2019s configuration for all paths. You can also place an empty *index.html* file in the web server root, which will instead display an empty page. This approach doesn\u2019t provide a strong level of protection and is only recommended as a temporary solution until the web server configuration can be updated.\\n2. Verify that directory metadata is hidden.\\n3. Review your application\u2019s access control policy and confirm that it conforms to current security best practices.\\n\\nFurther documentation:  https://owasp.org/Top10/A01_2021-Broken_Access_Control/\"\n    },\n    {\n        \"issueTypeId\": \"F5AdvancedWebApplicationFirewall\",\n        \"remediationGuidance\": \"Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\\n\\nXpanse recommends performing the following steps to keep firewall devices secure:\\n\\n1. Ensure the firewall\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts.\"\n    },\n    {\n        \"issueTypeId\": \"F5BigIpAccessPolicyManager\",\n        \"remediationGuidance\": \"F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\\n\\nXpanse recommends the following mitigation steps:\\n\\n1. Secure your BIG-IP systems by not exposing them to the public internet.\\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP\u2019s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"F5BigIpPlatform\",\n        \"remediationGuidance\": \"F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\\n\\nXpanse recommends the following mitigation steps:\\n\\n1. Secure your BIG-IP systems by not exposing them to the public internet.\\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP\u2019s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"F5BigIpTmui\",\n        \"remediationGuidance\": \"F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\\n\\nXpanse recommends the following mitigation steps:\\n\\n1. Secure your BIG-IP systems by not exposing them to the public internet.\\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP\u2019s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"F5BigIqServer\",\n        \"remediationGuidance\": \"F5 BIG-IP is known to be vulnerable to authentication bypass and remote code execution vulnerabilities, most notably https://unit42.paloaltonetworks.com/cve-2022-1388/. Successful exploitation could lead to malicious actors gaining administrative control of affected systems.\\n\\nXpanse recommends the following mitigation steps:\\n\\n1. Secure your BIG-IP systems by not exposing them to the public internet.\\n2. Ensure BIG-IP systems are running the latest version and that all security patches are applied promptly.\\n3. Review passwords and user accounts and ensure no accounts have default passwords. BIG-IP\u2019s most significant weakness is its default configuration, which has easily guessable passwords for the root and admin user. Publicly exposed instances of BIG-IP that run on this default configuration are particularly susceptible to intrusion from malicious actors since the attack complexity is low.\\n4. Disable unused services and add-on modules. This can be done by using the bigstart and configuration utilities provided by BIG-IP.\\n5. Audit port lockdown configurations to ensure only necessary ports are accessible. It is strongly recommended that administrative ports 443 and 22 are not publicly exposed and only accessible through a firewall.\\n6. Isolate BIG-IP systems behind a firewall or VPN and implement network segmentation to protect your BIG-IP infrastructure from unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"FatPipeIPVPN\",\n        \"remediationGuidance\": \"Certain FatPipe IPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to identify the asset owner.\\n2. If version number is not identified, determine what version is running on the device to infer vulnerability.\\n3. Work to patch the device to the latest secure version if it is found to be vulnerable.\\n4. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"FatPipeMPVPN\",\n        \"remediationGuidance\": \"Certain FatPipe MPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to identify the asset owner.\\n2. If version number is not identified, determine what version is running on the device to infer vulnerability.\\n3. Work to patch the device to the latest secure version if it is found to be vulnerable.\\n4. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"FatPipeVPNDevice\",\n        \"remediationGuidance\": \"FatPipe devices currently have high impact CVEs available for them that allow for threat actors to breach organizations and gain access to internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to understand which specific FatPipe device is being used.\\n2. Determine what version is running on the device to infer vulnerability.\\n3. More information regarding vulnerable versions and impact can be found on the published https://www.ic3.gov/Media/News/2021/211117-2.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"FatPipeWARP\",\n        \"remediationGuidance\": \"Certain FatPipe WARP devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to identify the asset owner.\\n2. If version number is not identified, determine what version is running on the device to infer vulnerability.\\n3. Work to patch the device to the latest secure version if it is found to be vulnerable.\\n4. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"ForeScoutCounterACT\",\n        \"remediationGuidance\": \"Due to the control and visibility a network access control (NAC) device has for an organization&#39;s network, it is recommended that this device not be accessible from the public internet. It is recommended to identify the asset owner and work with them to disable public internet access to the device.\"\n    },\n    {\n        \"issueTypeId\": \"ForgerockIdentityManagement\",\n        \"remediationGuidance\": \"If an attacker gains access to a ForgeRock Identity Management server, they can potentially perform unauthorized actions such as stealing sensitive user data, manipulating user accounts, and gaining unauthorized access to other connected systems.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Ensure the ForgeRock Identity Management server is running on the latest version and all security patches are applied. Regularly check for updates and apply them in a timely manner to fix known vulnerabilities.\\n2. Implement proper access controls, such as role-based access control (RBAC), to restrict unauthorized access to the server. Limit administrative access to a select group of users, and enforce strong authentication mechanisms like multi-factor authentication (MFA).\\n3. Disable or remove all unnecessary services, ports, and modules to minimize the attack surface. Follow the ForgeRock hardening guide to properly configure the server and apply security best practices.\\n4. Configure the server to use secure communication protocols like HTTPS (TLS/SSL) to encrypt data in transit. Make sure to use strong encryption algorithms and valid certificates issued by a trusted certificate authority.\\n5. Continuously monitor the server for any suspicious activities or access attempts. Implement logging and auditing mechanisms to keep track of all server activities. Regularly review logs and perform security audits to identify and remediate any potential security threats.\\n\\nThe ForgeRock IDM security guide can be found https://backstage.forgerock.com/docs/idm/7/security-guide/.\"\n    },\n    {\n        \"issueTypeId\": \"ForgeRockOpenAM\",\n        \"remediationGuidance\": \"If you have identified an exposed instance of ForgeRock OpenAM, it is important to take immediate action to remediate the vulnerability and protect your system from potential attacks. Here are some steps you can take:\\n\\n1. Quarantine the system to ensure no further potential compromise takes place.\\n2. Review all available system and network logs to determine if a compromise took place. If a compromise has taken place take all necessary actions to contain, eradicate, and remediate impacted systems.\\n3. Check if there is a new version of ForgeRock OpenAM available, and upgrade to the latest version if possible. This may include updating dependencies and plugins as well.\\n4. Review all security controls and ensure that only the necessary ports are open. Restrict access to the ForgeRock OpenAM from only trusted sources.\\n5. Ensure that the system hosting the ForgeRock OpenAM is hardened and configured securely. This includes configuring secure passwords, limiting user access, and disabling unnecessary services.\\n6.Implement monitoring and alerts to detect any future vulnerabilities or attacks. This may include setting up alerts for unusual activity, configuration changes, or failed login attempts.\\n7. Conduct a vulnerability scan of the system to identify any other vulnerabilities that may exist.\\n8. Follow security best practices for securing and maintaining your system, such as regularly applying security patches and keeping software up-to-date.\"\n    },\n    {\n        \"issueTypeId\": \"FortinetDevice\",\n        \"remediationGuidance\": \"Fortinet devices should only be accessible on an organization&#39;s private network. These assets should be monitored closely and access control lists should be used to restrict access. To ensure the device is secure:\\n\\n* Determine the device that is getting flagged by the issue.\\n* Consider if the device should be publicly accessible.\\n* Visit the https://www.fortiguard.com/psirt and ensure that you are running the latest secure version of the identified product.\"\n    },\n    {\n        \"issueTypeId\": \"FortinetFortigateSslVpn\",\n        \"remediationGuidance\": \"VPN devices are often publicly accessible and, as a result, are a frequent target of sophisticated attacks. Fortigate SSL-VPN is vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2023-27997, which could lead to unauthenticated attackers performing remote code execution. To secure your instances of Fortigate SSL-VPN, Xpanse recommends implementing a Zero-Trust architecture and staying up-to-date on the latest patches:\\n\\n1. Create a security zone for all VPN traffic. Using security zones is a security best practice for VPNs because it creates a tunnel interface and gives organizations visibility into the IP pools used for remote users. This helps with proactively detecting intruders and containing attacks for remote users. Please note that split tunneling is not recommended as it may lead to critical data being intercepted by malicious actors.\\n2. Create NAT policies to secure traffic and use user groups and application IDs to reduce your organization\u2019s attack surface.\\n3. Closely monitor traffic logs by surveying the egress traffic.\\n4. Ensure that disabling Fortigate SSL-VPN is only allowed for a short interval of time (the default timeout is 30 min).\\n5. Enable 2FA for all users\"\n    },\n    {\n        \"issueTypeId\": \"FortinetFortiNAC\",\n        \"remediationGuidance\": \"Fortinet FortiNAC is vulnerable to CVE-2022-39952, a remote-code execution vulnerability with a proof-of-concept exploit that was publicly exploited. It is critical that:\\n\\n* All FortiNAC devices are updated to the latest security patch.\\n* Ensure that no administrator panels are publicly exposed. An attacker that gains access to FortiNAC internals will be able to compromise a network.\\n* The complete list of https://www.fortiguard.com/psirt?product&#61;FortiNAC should be actively monitored. These advisories include version information and latest recommended solutions.\"\n    },\n    {\n        \"issueTypeId\": \"FortinetFortiOS\",\n        \"remediationGuidance\": \"Fortinet devices should only be accessible on an organization&#39;s private network. These assets should be monitored closely and access control lists should be used to restrict access. To ensure the device is secure:\\n\\n* Determine the device that is getting flagged by the issue.\\n* Consider if the device should be publicly accessible.\\n* Visit the https://www.fortiguard.com/psirt and ensure that you are running the latest secure version of the identified product.\"\n    },\n    {\n        \"issueTypeId\": \"FortraGoAnywhereManagedFileTransfer\",\n        \"remediationGuidance\": \"Fortra GoAnywhere Managed File Transfer (MFT) has been affected by numerous security vulnerabilities. There are a number of steps that should be taken to ensure your organization remains secure.\\n\\n1. Determine if this asset must be publicly accessible. If there is not clear business need for this file transfer system to be publicly accessible (for example, if it were solely used for internal use) consider removing the service from the public internet.\\n2. Upgrade MFT to the latest secure version.\"\n    },\n    {\n        \"issueTypeId\": \"FoxServer\",\n        \"remediationGuidance\": \"Due to the potential for sensitive information to be passed through Niagara, ensure that Niagara is running the latest security patch and the control server is not exposed to the public Internet.\"\n    },\n    {\n        \"issueTypeId\": \"FranklinFuelingSystems\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Franklin Fueling Systems device, they can potentially manipulate the fuel inventory data, disrupt the leak detection system, and compromise delivery reconciliation. This could lead to financial loss, undetected leaks or spills, environmental damage, and non-compliance with regulatory requirements. Additionally, the attacker could potentially gain access to sensitive information related to fuel deliveries and transactions, leading to data breaches and reputational harm for the affected business.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the device within a separate network segment, restricting access to only authorized users and systems.\\n2. Implement proper firewall rules to block unauthorized access and limit inbound and outbound traffic to the device.\\n3. Enable strong authentication mechanisms, such as multi-factor authentication (MFA), to prevent unauthorized access.\\n4. Ensure that the device firmware is up-to-date and apply security patches regularly to fix any known vulnerabilities.\\n5. Use encrypted communication channels, such as VPNs or secure protocols like HTTPS, to protect data transmission between the device and authorized systems.\\n6. Regularly monitor and review logs for any signs of unauthorized access or suspicious activity, and conduct security audits to ensure compliance with best practices and regulations.\"\n    },\n    {\n        \"issueTypeId\": \"FreeBSD\",\n        \"remediationGuidance\": \"FreeBSD has been widely targeted by nefarious actors leading to the release of a multitude of CVEs with a CVSS of 10.0. An unpatched or misconfigured instance of FreeBSD in your environment poses a serious security risk. The following steps are recommended to keep your environment safe from attacks targeting FreeBSD:\\n\\n1. Ensure your instance of FreeBSD is patched and up to date with the latest version available. https://www.freebsd.org/releases/\\n2. Ensure your instance of FreeBSD is sitting behind security controls such as a WAF, NGFW, and/or VPN infrastructure.\\n3. Ensure you have verbose logging on your instance of FreeBSD to effectively monitor for attacks targeting these systems.\\n4. Implement strict access controls on any FreeBSD system that may be public facing\\n\\nReferences:\\n* https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/\"\n    },\n    {\n        \"issueTypeId\": \"FujifilmSynapseRIS\",\n        \"remediationGuidance\": \"1. Medical record systems should not be directly accessible from the internet as they pose a significant risk of exposing Protected Health Information (PHI).\\n2. It is imperative to take a risk-based approach considering legal and regulatory issues associated with having a medical record system exposed to the internet.\\n3. Guidelines and U.S. regulatory policy regarding securing Electronic Health Records (EHR) can be found https://www.hhs.gov/hipaa/index.html\"\n    },\n    {\n        \"issueTypeId\": \"GithubCertificate\",\n        \"remediationGuidance\": \"There is no inherent risk with Github related certificates. However, ensure that the Github service is intentionally exposed and no confidential information is exposed. If not, work to identify the asset owner and remove the device from being publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"GitLab\",\n        \"remediationGuidance\": \"Compromise of a GitLab instance could potentially lead to source code in the repos being leaked or stolen.\\nIt is recommended to identify the asset owner and verify that GitLab needs to be exposed to the public internet. If not, work with them to remove it.\\nIf GitLab needs to be exposed to the internet, it is recommended to follow their documentation on securing the installation which can be found https://docs.gitlab.com/ee/security/\\nIt is also recommended to place the instance behind security controls such as a Web Application Firewall (WAF).\"\n    },\n    {\n        \"issueTypeId\": \"GlobalscapeEFT\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Globalscape EFT instance, they could potentially steal sensitive data being transferred through the system, modify or delete files, and even gain access to other systems connected to the EFT instance.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Ensure that the EFT instance is running the latest version with all necessary patches and updates.\\n2. Configure the EFT instance to use secure protocols such as SFTP or HTTPS.\\n3. Implement strong password policies and enable two-factor authentication.\\n4. Configure firewalls and network access controls to limit access to the EFT instance to only authorized users and systems.\\n5. Implement monitoring and logging to detect and alert on any suspicious activity.\\n6. Regularly review and analyze logs and alerts to identify potential security issues.\\n7. Conduct regular vulnerability scans and penetration testing to identify potential vulnerabilities and security gaps.\\n8. Ensure that all employees are trained on secure file transfer practices, including how to detect and report suspicious activity.\\n9. Implement security information and event management (SIEM) tools to aggregate and analyze security events across the organization.\\n10. Implement encryption for data at rest and in transit to protect sensitive information from unauthorized access.\\n\\nFor more information regarding best practices for Globalscape EFT, please reference the following documentation found https://kb.globalscape.com/Knowledgebase/11312/Configuration-and-Security-Best-Practices.\"\n    },\n    {\n        \"issueTypeId\": \"GlpiServiceManagement\",\n        \"remediationGuidance\": \"It is not recommended to make GLPI (Gestionnaire Libre de Parc Informatique) accessible on the public internet as it may pose security risks. GLPI is primarily designed for internal use within an organization, and exposing it to the public internet may increase the chances of unauthorized access, hacking, or other security threats. For example, GLPI is susceptible to CVE-2022-35914, a remote code execution vulnerability.\\n\\nIf you need to access GLPI from outside your organization&#39;s network, it is recommended to use a VPN (Virtual Private Network) or other secure remote access solutions. This way, you can ensure that the application is only accessible to authorized users and that all communications are encrypted and secure.\"\n    },\n    {\n        \"issueTypeId\": \"GoogleCloud\",\n        \"remediationGuidance\": \"If you have identified an exposed vulnerable instance on Google Cloud, you should take immediate steps to remediate the situation to prevent any potential security breaches or data loss. Here are some steps you can follow to remediate an exposed vulnerable instance:\\n\\n1. Once you have identified the vulnerable instance, isolate it from the rest of your network to prevent further exposure and potential attacks.\\n2. Check for available patches or updates for the software or application running on the instance. Apply the relevant patches or updates as soon as possible.\\n3. If the instance was using default credentials, change them immediately to prevent any unauthorized access.\\n4. Review your security policies and ensure that they are up-to-date and effective. Check for any misconfigurations or security gaps that may have contributed to the exposure.\\n5. Monitor the instance for any suspicious activity or unusual traffic patterns. Set up alerts and notifications to ensure that you are notified immediately of any potential security threats.\\n6. Perform regular vulnerability scans to identify any new vulnerabilities and potential security risks.\"\n    },\n    {\n        \"issueTypeId\": \"GoogleWebFrameworkAngular\",\n        \"remediationGuidance\": \"Angular when unpatched and misconfigured poses a serious security risk to any organization as severe vulnerabilities have been recently released including remote code execution (RCE).\\n\\n1. Given the nature of CVE-2021-4231, Xpanse recommends enforcing strict input sanitation measures on webpages built on Angular to prevent similar exploits.\\n\\n2. Ensure monitoring is configured to detect attacks such as cross-site scripting, cross-site request forgery, SQL injection, and other nefarious activities.\"\n    },\n    {\n        \"issueTypeId\": \"Grafana\",\n        \"remediationGuidance\": \"Grafana is vulnerable to a number of critical vulnerabilities, such as CVE-2022-31107 and CVE-2022-26148, which can lead to authentication bypass and exposed passwords.\\n1. Update Grafana to the latest secure version.\\n2. Validate that the information displayed in Grafana should be publicly accessible. If not, work with the asset owner to remove the Grafana instance from the public internet.\\n3. For in-depth vendor recommendations, visit https://grafana.com/go/webinar/grafana-security-features/.\"\n    },\n    {\n        \"issueTypeId\": \"GrandstreamNetworksUCM6200SeriesDevice\",\n        \"remediationGuidance\": \"Evaluate whether or not this device should be exposed to the public internet.\\nIf it is determined that this device should not be exposed to the public internet, identify the asset owner and work with them to remove the device from being publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"H3CFirewall\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed H3C Firewall, they can potentially modify security rules allowing unauthorized access and malicious traffic into the protected network.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Update the firmware to the latest version.\\n2. Replace default credentials with strong, unique ones.\\n3. Restrict remote management access.\\n4. Configure access control lists.\\n5. Monitor logs for suspicious activity.\\n6. Periodically review and adjust firewall settings to maintain a secure network environment.\"\n    },\n    {\n        \"issueTypeId\": \"H3CRouter\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed H3C Router, they can intercept and manipulate network traffic, compromising sensitive data and connected devices. Additionally, they may modify router configurations, create network vulnerabilities, launch DDoS attacks, or use the compromised router as a pivot point for further attacks within the organization&#39;s network.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Ensure the H3C router is running the latest firmware version to fix known vulnerabilities and enhance security features.\\n2. Replace default usernames and passwords with strong, unique credentials to prevent unauthorized access.\\n3. Disable remote management features, such as Telnet and SSH, if not required, to reduce the attack surface.\\n4. Configure access control lists to restrict incoming and outgoing traffic to specific IP addresses and ports, limiting potential threats.\\n5. Use HTTPS for secure web-based management and disable HTTP access.\\n6. Turn off unused services and protocols, such as UPnP, SNMP, and FTP, to minimize potential attack vectors.\\n7. Set up router logs and monitor them regularly for any suspicious activity or security incidents.\\n8. Separate the router&#39;s internal network from external networks using VLANs or subnets to limit the scope of potential attacks.\\n9. Activate the router&#39;s built-in firewall to filter and block malicious traffic.\\n10. Periodically review the router&#39;s settings and make necessary changes to maintain a secure environment.\"\n    },\n    {\n        \"issueTypeId\": \"HadoopServer\",\n        \"remediationGuidance\": \"Apache Hadoop servers should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\\n\\n1. Identify the exposed Apache Hadoop server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Ensure that Apache Hadoop is configured in secure mode allowing for data encryption and Role Based Access Controls (RBAC).\\n3. Apache Hadoop server security best practices can be followed https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-common/SecureMode.html.\"\n    },\n    {\n        \"issueTypeId\": \"HclBigFixPlatform\",\n        \"remediationGuidance\": \"Compromise of an asset belonging to the BigFix Platform can lead to data loss or further compromise of other assets due to the broad reach that the BigFix platform can have in an organization. It is recommended to have the root server in the BigFix Platform behind security tooling with appropriate logging enabled.\\nFor more information about secure configurations and architecture, reference the BigFix Platform Wiki documents found https://bigfix-wiki.hcltechsw.com/wikis/home?lang&#61;en-us#!/wiki/BigFix%20Wiki/page/Security%20Overview.\"\n    },\n    {\n        \"issueTypeId\": \"HikvisionDevice\",\n        \"remediationGuidance\": \"If attackers gain access to a publicly exposed Hikvision device, they can extract or infer sensitive information about physical infrastructure or internal operations.\\n\\nTo secure Hikvision devices, it is recommended to perform the following:\\n\\n1. Isolate Hikvision devices from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Hikvision devices should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Hikvision devices are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Hikvision devices. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"HoneywellAccessSystems\",\n        \"remediationGuidance\": \"If you have identified that your Honeywell Access System has been exposed, the following steps should be taken:\\n\\n1. Disconnect the Honeywell Access System from the network to prevent any further access to the exposed system.\\n2. Assess the potential risks associated with the exposure, including the impact on the system, data, or any other connected systems.\\n3. Ensure you have proper security controls in place such as firewalls, intrusion detection systems, and antivirus software to prevent unauthorized access.\\n4. Change all default and existing passwords, and use strong passwords that are difficult to guess.\\n5. Ensure that the Honeywell Access System is running the latest firmware and software, which often includes security patches and updates.\\n6. Regularly monitor the system for any suspicious activity or unauthorized access.\\n7. Review logs to determine if any nefarious activity has taken place prior to the discovery of the exposed device.\"\n    },\n    {\n        \"issueTypeId\": \"HoneywellNetAXS\",\n        \"remediationGuidance\": \"NetAXS is often used to manage access to critical infrastructure sites and should not be publicly exposed on the internet. Should an attacker gain access to NetAXS, they may gain complete control of all access entry points of a physical site that are reachable remotely. This type of attack may translate into attackers being able to lock/unlock doors, revoke access for key personnel, or laterally traverse the network and infiltrate other systems integrated with NetAXS.\\n\\nXpanse recommends securing NetAXS by taking the following steps:\\n\\n1. Ensure that no access entry points are using default installer codes. This is a typical and low-complexity attack vector where attackers can quickly discover or guess the default installer code for the product and gain access to the system.\\n2. Place NetAXS behind a firewall and implement a DMZ network architecture to isolate NetAXS from other critical systems.\\n3. Expeditiously update NetAXS to use the latest patches.\\n4. Implement strict access control policies that follow the principle of least privilege. This means that all users should have access only to the essential components that allow them to do their jobs.\\n5. Regularly monitor network activity and user engagement and set up robust alerting.\"\n    },\n    {\n        \"issueTypeId\": \"HoneywellNiagaraBCS\",\n        \"remediationGuidance\": \"If an attacker successfully compromises an exposed Honeywell Niagara Building Control System, they could potentially gain complete control over the targeted building automation system (BAS). This could allow them to access sensitive data, such as HVAC and lighting system configurations, and even manipulate them to cause physical damage or disrupt building operations.\\n\\nIt is recommended to perform the following:\\n1. Disconnect the server from the network to isolate it for investigation.\\n2. Investigate the extent of the compromise and identify any potential areas of vulnerability or compromise (if any).\\n3. Ensure that the server is running the latest version of the Honeywell Niagara Building Control System software and that all patches and updates have been applied to address any known vulnerabilities.\\n4. Reset all passwords associated with the server and any connected systems to strong, unique passwords that are difficult to guess or crack.\\n5. Consider implementing additional security measures, such as firewalls, intrusion detection systems, access controls, and network segmentation, to prevent future attacks and improve overall security posture.\"\n    },\n    {\n        \"issueTypeId\": \"HoneywellXLWebController\",\n        \"remediationGuidance\": \"If you have identified a Honeywell XL Web Controller in your network that has been exposed, the following steps can be taken to remediate the exposure of the device:\\n\\n1. Disconnect the Honeywell XL Web Controller from the network to prevent any further access to the exposed system.\\n2. Assess the potential risks associated with the exposure, including the impact on the system, data, or any other connected systems.\\n3. Implement proper security control measures such as firewalls, intrusion detection systems, and antivirus software to prevent unauthorized access.\\n4. Change all default and existing passwords, and use strong passwords that are difficult to guess.\\n5. Ensure that the Honeywell XL Web Controller is running the latest firmware and software, which often includes security patches and updates.\\n6. Elevate monitoring for the system to identify any suspicious activity or unauthorized access.\\n7. Review logs to determine if any compromise took place prior to the discovery of the exposed device.\"\n    },\n    {\n        \"issueTypeId\": \"HttpStatusCode404\",\n        \"remediationGuidance\": \"While there is no inherent security risk for an HTTP server to return a 404 status code, there are a number of steps that can be done to ensure applications that should be accessible remain accessible:\\n1. Identify the cause of the 404 error: Review the server logs to determine the cause of the error. It could be due to a broken link, a deleted page, or a mistyped URL.\\n2. If the page has been deleted or moved, you can redirect the user to a relevant page using a 301 redirect.\"\n    },\n    {\n        \"issueTypeId\": \"IBMAsperaFaspex\",\n        \"remediationGuidance\": \"Public facing instances of IBM Aspera Faspex are at far greater risk for exploitation due to multiple vulnerabilities and common attack methodologies. Additionally, hosting this service on your public facing infrastructure increases your attack surface and should be avoided if possible. It is recommended to restrict access to your IBM Aspera Faspex application by taking the following steps:\\n\\n1. If your organization\u2019s IBM Aspera Faspex service must be public facing due to your network architecture, place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\\n2. Block all unexpected outbound network traffic to prevent potentially propagating confidential/sensitive data spills due to malware/exploits running on/against the system.\\n3. Ensure you have the latest version of IBM Aspera Faspex deployed as all prior versions of the application to date have been noted as vulnerable to multiple different attack methodologies.\"\n    },\n    {\n        \"issueTypeId\": \"IBMCognosAnalytics\",\n        \"remediationGuidance\": \"Public facing instances of IBM Cognos Analytics are at far greater risk for exploitation due to multiple vulnerabilities and common attack methodologies. Additionally, hosting this service on your public facing infrastructure increases you attack surface and should be avoided if possible. Xpanse recommends restricting access to your IBM Cognos Analytics application by taking the following steps:\\n\\n1. If your organization\u2019s IBM Cognos Analytics service must be public facing due to your network architecture place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\\n\\n2. Block all unexpected outbound network traffic to prevent potentially propagating confidential/sensitive data spills due to malware/exploits running on/against the system.\\n\\n3. Ensure you have the latest version of IBM Cognos Analytics deployed as all prior versions of the application to date have been noted as vulnerable to multiple different attack methodologies.\"\n    },\n    {\n        \"issueTypeId\": \"IBMWebSphereApplicationServer\",\n        \"remediationGuidance\": \"To secure IBM WebSphere Application Server instances, it is recommended to perform the following:\\n\\n1. Isolate IBM WebSphere Application Server instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all IBM WebSphere Application Server instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that IBM WebSphere Application Server instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on IBM WebSphere Application Server instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"IgniteRealtimeOpenfire\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Ignite Realtime Openfire instance, they may be able to eavesdrop on conversations, steal sensitive information, or even take control of the server. This could lead to data breaches, compromised user accounts, and potentially significant financial and reputational damage to the affected organization.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Configure secure communication using SSL/TLS to encrypt communication between the Openfire server and clients, preventing unauthorized access to sensitive information.\\n2. Implement access controls, such as role-based access control (RBAC), to restrict access to the server and its resources to authorized users only, reducing the risk of unauthorized access or data breaches.\\n3. Configure firewall rules to restrict incoming and outgoing traffic to necessary ports and protocols, preventing malicious traffic from reaching the server and limiting the attack surface.\\n4. Set strong authentication policies, including password complexity requirements, multi-factor authentication, and regular password expiration, to ensure that user accounts are secure and protected from brute-force attacks and other forms of unauthorized access.\\n5. Monitor system logs for suspicious activity and set up alerts for potential security incidents, enabling quick detection and response to potential threats.\\n6. Conduct regular security audits to identify and remediate vulnerabilities, ensuring that the Openfire server and associated systems remain secure over time.\\n7. Keep the Openfire server and associated software up-to-date with the latest security patches and updates, ensuring that any known vulnerabilities are addressed in a timely manner.\"\n    },\n    {\n        \"issueTypeId\": \"IkeV1Server\",\n        \"remediationGuidance\": \"IKEv1 is deprecated and should no longer be used. IKEv2 is a faster, more secure, and more reliable alternative. Details and reasoning behind the move from IKEv1 to IKEv2 can be found in the IETF https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-ikev1-algo-to-historic.\"\n    },\n    {\n        \"issueTypeId\": \"ImapServer\",\n        \"remediationGuidance\": \"Some of IMAP&#39;s most glaring security issues are its unencrypted user login data transmission and lack of compatibility with modern authentication systems like MFA. Attackers often attempt brute-force authentication against IMAP by employing credential-spraying attacks,  where weak or public passwords are enumerated to gain unauthorized access to the server.\\n\\nXpanse recommends taking the following steps to secure IMAP instances:\\n1. Place IMAP instances behind a firewall to monitor and control e-mail server traffic.\\n2. Implement IMAPS, which is IMAP with implicit TLS encryption over port 993. Using TLS will help keep user e-mail sessions more secure as traffic will be encrypted. Another option is using IMAP with explicit TLS over port 143, which allows traffic to be encrypted if both client and server support STARTTLS.\\n3. Do not use third-party e-mail clients that don&#39;t support MFA, as MFA can be easily bypassed when attempting authentication.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureApacheAPISIX\",\n        \"remediationGuidance\": \"Apache APISIX is known to be vulnerable to authentication bypass and remote code execution attacks, most notably https://nvd.nist.gov/vuln/detail/cve-2022-24112, which could lead to malicious actors gaining access to the admin dashboard interface. These types of attacks could allow unauthorized users to bring services offline and/or extract critical information about an organization\u2019s infrastructure.\\n\\nTo remediate instances affected by CVE-2022-24112, it is recommended to update APISIX to versions 2.12.1 or 2.10.4. This vulnerability can also be mitigated by explicitly commenting out batch-requests in the conf/config.yaml and conf/config-default.yaml files and restarting Apache APISIX.\\n\\nXpanse recommends securing instances of Apache APISIX by following these best practices:\\n\\n1. Place Apache APISIX gateways behind a web application firewall (WAF) and ensure that there are comprehensive rules in place to restrict access only to intended audiences.\\n2. Ensure that Apache APISIX gateways are running on the latest version and implement a patch management process to facilitate applying security updates in a timely manner.\\n3. Implement rate-limiting to prevent traffic overload and Distributed Denial of Service (DDoS) attacks.\\n4. Enable robust logging and closely monitor ingress and egress traffic.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureApacheDruid\",\n        \"remediationGuidance\": \"It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\\n\\nXpanse recommends securing your database software by taking the following steps:\\n\\n1. Isolate the database from the public internet by placing it behind a VPN.\\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureApacheWebServer\",\n        \"remediationGuidance\": \"1. Verify backported versions requires system access and cannot be accurately done from the Internet, it is recommended to confirm vulnerabilities on the system through a change log or other means.\\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Apache Web Server and apply latest security updates. This can be done via https://httpd.apache.org/download.cgi.\\n3. Ensure all files outside the document root are secured with &#39;require all denied&#39; in the server&#39;s configuration. Details on how to do so can be found at https://httpd.apache.org/docs/2.4/misc/security_tips.html.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAppleCups\",\n        \"remediationGuidance\": \"1. CUPS servers should not be directly accessible from the internet as they pose a significant risk as vulnerabilities are constantly being found for the service. Evaluate if this CUPS server needs to be exposed to the public internet for business purposes.\\n2. If the server does need to be exposed to the public internet or an internal network, Xpanse recommends reconfiguring the server to leverage the Internet Printing Protocol (IPP) along with Access Control Lists (ACL), authentication, and encrypted communication.\\n3. Configuration of secure IPP can be found https://www.rfc-editor.org/rfc/rfc7472.html.\\n4. Update to the latest secure version.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianBamboo\",\n        \"remediationGuidance\": \"Successful exploitation of CVE-2022-26136 would allow a remote, unauthenticated attacker to bypass authentication or execute malicious Javascript in the browser by sending HTTP requests crafted so that either the authentication logic used by Servlet Filters from third party apps would not be invoked or by bypassing the Servlet Filters entirely. Exploitation of CVE-2022-26137 would involve gaining access to the Servlet Filter used to respond to CORS requests resulting in CORS bypass.\\n\\nAtlassian has not exhaustively determined all possible attack vectors for these two vulnerabilities, so the impact of exploitation could be even more severe than described.\\n\\nXpanse recommends using information surfaced by this policy to assess whether your organization\u2019s Atlassian Bamboo Server is impacted and upgrade to the latest available patch if needed.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianConfluenceDataCenter\",\n        \"remediationGuidance\": \"In certain versions of Confluence Server and Data Center threat actors are able to remotely execute arbitrary code and view restricted resources. To reduce the likelihood of such attempts, ensure the following:\\n\\n1. Best practice is to update to current versions, as outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Confluence Server and Data Center. Latest version can be found at https://www.atlassian.com/software/confluence/download-archives.\\n2. If incremental updates cannot be achieved, there are temporary workarounds offered on Confluence Support under \u201cMitigation\u201d at https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html#.\\n3. Ensure Confluence Server and Data Center are not publicly accessible on the Internet and only on trusted local networks.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianConfluenceServer\",\n        \"remediationGuidance\": \"In certain versions of Confluence Server and Data Center threat actors are able to remotely execute arbitrary code and view restricted resources. To reduce the likelihood of such attempts, ensure the following:\\n\\n1. Best practice is to update to current versions, as outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Confluence Server and Data Center. Latest version can be found at https://www.atlassian.com/software/confluence/download-archives.\\n2. If incremental updates cannot be achieved, there are temporary workarounds offered on Confluence Support under \u201cMitigation\u201d at https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html#.\\n3. Ensure Confluence Server and Data Center are not publicly accessible on the Internet and only on trusted local networks.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianCrowdServer\",\n        \"remediationGuidance\": \"CVE-2019-11580 is a remote code execution vulnerability while CVE-2022-43782 is an improper authentication vulnerability.\\nIn order to remediate CVE-2019-11580, it is recommended to update to the latest secure version.\\n\\nIf that is not possible, the vulnerability can be remediated by performing the following:\\n1. Stop Crowd\\n2. Find and delete any pdkinstall-plugin jar files from the Crowd installation directory and the data directory\\n3. Remove the pdkinstall-plugin jar file from /crowd-webapp/WEB-INF/classes/atlassian-bundled-plugins.zip\\n4. Start Crowd\\n5. Check that there are no pdkinstall-plugin jar files in the installation directory or the data directory.\\n\\nMore information regarding remediation guidance from Atlassian can be found https://jira.atlassian.com/browse/CWD-5388\\n\\nIn order to remediate CVE-2022-43782, it is recommended to update to any of the following fix versions: 4.4.4, 5.0.3, 5.1.0.\\n\\nMore information regarding how to remediate CVE-2022-43782 can be found https://jira.atlassian.com/browse/CWD-5888\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianCrucible\",\n        \"remediationGuidance\": \"Identify the server or service owner of the affected asset and work to upgrade your Atlassian Crucible instance to version 4.8.9 or greater.\\nVendor Advisory can be found https://jira.atlassian.com/browse/FE-7387\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianFisheye\",\n        \"remediationGuidance\": \"Versions of Atlassian Fisheye 4.8.9 and below may be vulnerable to CVE-2021-43958, a vulnerability allowing an attacker to brute force user login credentials.\\nXpanse recommends identifying the server or service owner of the affected asset and work to upgrade your Atlassian Fisheye instance to version 4.8.9 or greater.\\nVendor Advisory can be found https://jira.atlassian.com/browse/FE-7387.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianJiraServer\",\n        \"remediationGuidance\": \"If you have identified a vulnerable instance of Atlassian Jira, it is important to take immediate action to remediate the issue to prevent any potential security breaches. Here are some steps you can follow to remediate the issue:\\n\\n1. Disconnect the device from the network to prevent any potentially further compromise or lateral movement.\\n2. Determine if any compromise of the device took place. If a compromise is discovered take the appropriate steps to contain, eradicate, and remediate the compromise(s).\\n3. Apply the necessary patches or updates to your Atlassian Jira instance. Atlassian typically releases security patches for known vulnerabilities, so make sure to check their website for the latest updates.\\n4. Review your security settings and make sure that your Atlassian Jira instance is configured correctly. This includes reviewing access controls, user permissions, and other security settings.\\n5. Monitor your Atlassian Jira instance for any suspicious activity, such as unauthorized access attempts or unusual traffic patterns.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureAtlassianJiraServiceManagement\",\n        \"remediationGuidance\": \"In order to remediate instances of Jira Service Management that are vulnerable to CVE-2023-22501, the vendor recommends upgrading the affected instance to a patched version. If that cannot be accomplished, the vendor states that the version-specific servicedesk-variable-substitution-plugin JAR file can be upgraded as a temporary workaround. Recommended security guidelines that are not specific to CVE-2023-22501 are as follows:\\n\\n1. Quarantine the vulnerable server/application to prevent further potential exploits, lateral movement, data loss, or footholds in your environment.\\n2. Identify the specific vulnerability affecting the instance of Jira Service Management.\\n3. Once you have identified the vulnerability, apply any available patches or updates to the instance of Jira Service Management to remediate the vulnerability.\\n4. Ensure that the instance of Jira Service Management is configured with appropriate security settings, such as SSL encryption, two-factor authentication, and access controls.\\n5. Review logs associated with the device to include network logs, application logs, IPS/IDS logs, EDR logs, OS logs, etc. to determine if any compromise as a result of the vulnerable asset took place. Then contain, eradicate, and remediate appropriately.\\n6. Continue to monitor all instances of Jira Service Management for future vulnerabilities and apply patches and updates as necessary to ensure ongoing proficient security.\\n\\nFor more information regarding CVE-2023-22501, please reference the following:\\n* https://nvd.nist.gov/vuln/detail/CVE-2023-22501\\n* https://confluence.atlassian.com/jira/jira-service-management-server-and-data-center-advisory-cve-2023-22501-1188786458.html\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCactiNetworkMonitoringTool\",\n        \"remediationGuidance\": \"CVE-2022-46169 allows an unauthenticated attacker to remotely execute arbitrary code on a server running a vulnerable version of Cacti (up to and including 1.2.22).\\n* It is recommended to patch the affected Cacti server to 1.2.23 or 1.3.0.\\n* Further information can be found at the NVD entry listed https://nvd.nist.gov/vuln/detail/CVE-2022-46169.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCiscoAdaptiveSecurityAppliance\",\n        \"remediationGuidance\": \"Due to the potential impact on business operations if this vulnerability is exploited, a number of steps should be followed to minimize risk:\\n1. Investigate whether this instance of Cisco ASA must be accessible on the public facing internet. If the instance must be publicly accessible, ensure that the instance is actively monitored for malicious behavior.\\n2. Determine if this specific instance is vulnerable to CVE-2022-29737. This can be done by visiting the https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-asa-ssl-vpn-heap-zLX3FdX.html.\\n3. Apply the latest security patch.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCiscoSecureAccessControlSystem\",\n        \"remediationGuidance\": \"Versions of Cisco Secure Access Control System flagged by this policy (versions prior to 5.8 patch 9) may be vulnerable to CVE-2018-0147, an insecure deserialization vulnerability that could lead to code execution.\\nIn order to remediate, it is recommended to update the device&#39;s version that was flagged by this policy to a version greater than 5.8 patch 9.\\nFurther information regarding the vulnerability and remediation recommendations can be found at the advisory from Cisco found https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2\\nThe vendor recommends updating to the latest version of Secure Access Control System (ACS).\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCiscoSmallBusinessRVSeriesRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCiscoWirelessLanController\",\n        \"remediationGuidance\": \"Certain configurations of Cisco Wireless LAN Controller are susceptible to CVE-2022-20695, a critical authentication bypass vulnerability.\\n\\n1. Determine if this instance has the macfilter radius compatibility setting set to other.\\n2. If it is set to other, the device is vulnerable.\\n3. It is recommended to remove the device from the public facing internet until it can be upgraded to the latest secure version, or until the macfilter can be turned off.\\n4. For more details on how to diagnose and remediate this issue, visit the https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-auth-bypass-JRNhV4fF.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCitrixApplicationDeliveryController\",\n        \"remediationGuidance\": \"This policy will surface Citrix ADC web interfaces that are publicly accessible, which is not considered a best practice from a security standpoint, as it could serve as an entry point for attackers into a critical part of your infrastructure.\\n\\nXpanse recommends placing your organization\u2019s ADCs behind a firewall and having robust logging to capture ADC traffic.\\n\\nTo protect against CVE-2022-27518, CVE-2019-19781, CVE-2023-3519, CVE-2023-3466, and CVE-2023-3467 upgrade to versions 13.1.49.13, 13.0.91.13, or 12.1.65.25.\\n\\nIt is also recommended to review results for both the regular and the insecure Citrix Application Delivery Controller policies in order to have a more holistic view of your organization\u2019s attack surface.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCitrixGateway\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Citrix Gateway, they can potentially compromise the organization&#39;s security by accessing sensitive data, deploying malware, and disrupting operations. This unauthorized access can lead to widespread damage, including data theft, service disruptions, and harm to the organization&#39;s reputation and financial stability.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Ensure proper firewall configurations to restrict unauthorized access.\\n2. Apply the latest security patches and updates.\\n3. Enforce multi-factor authentication.\\n4. Regularly review and adjust access control policies.\\n\\nMore information on security best practices can be found https://docs.netscaler.com/en-us/citrix-adc-secure-deployment.html#network-security.\\n\\nFurther information regarding the CVEs can be found on the vendor advisory https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCommunicationProtocol\",\n        \"remediationGuidance\": \"Enforcing strong transport layer security is an important step in securing an organization&#39;s attack surface. Using HTTPS ensures that all data is encrypted in transit and the certificate will help prevent impersonations. Best practice security recommendations include: \\n\\n1. Ensure all page redirects utilize HTTPS.\\n\\n2. Set the Strict-Transport-Security header and assign the max-age to two years (In this case, max-age would be set to 63072000). You should also include the preload directive. Depending on the configurations, you may also want to utilize the includeSubDomains directive.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureContentSecurity\",\n        \"remediationGuidance\": \"To secure the content on a webpage:\\n\\n1. Ensure all forms utilize HTTPS.\\n\\n2. Removed mixed content from a webpage. Mixed content opens up the website to sniffers and man-in-the-middle attacks.\\n\\n3. Set the Referrer-Policy header with the appropriate directive. For details on how this header works, visit the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureCrestronAirMedia\",\n        \"remediationGuidance\": \"Crestron AM-100 and AM-101 are vulnerable to CVE-2019-3929, a critical command injection vulnerability. To secure this device, consider the following:\\n\\n1. Immediately remove access to this service until it can be upgraded.\\n2. Upgrade to the latest secure version of AirMedia. For AM-100, upgrade to version 1.6.0.2 or later. For AM-101, upgrade to version 2.7.0.1 or later.\\n3. Monitor for future vendor https://www.crestron.com/Security/Security-Advisories-All.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureDellEMCNetWorker\",\n        \"remediationGuidance\": \"If you have an exposed insecure instance of Dell EMC NetWorker, it is critical to take immediate action to prevent unauthorized access and data breaches. Here are some steps you can take to remediate the issue:\\n\\n1. Determine the level of vulnerability and whether any data has been compromised.\\n2. Isolate the instance by disconnecting it from the network to prevent further unauthorized access.\\n3. Review network and host logs to determine if any compromise took place. \\n4. Update the Dell EMC NetWorker to the latest available version. This will ensure that any known vulnerabilities are patched.\\n5. Change any default passwords on the Dell EMC NetWorker to strong, unique passwords.\\n6. Review the access controls on the Dell EMC NetWorker to ensure that only authorized users have access.\\n7. Monitor the instance for unusual activity to detect any potential breaches.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureDLinkDCS930L\",\n        \"remediationGuidance\": \"D-Link DCS-930L cameras are vulnerable to remote code execution and CSRF attacks, and depending on network topology, they can serve as an entry point into your organization\u2019s network. This policy flags versions that are vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2016-11021.\\n\\nDue to the low attack complexity and the high risk for an unauthenticated attacker to perform remote code execution, Xpanse recommends patching DCS-930L to versions 2.12 and above.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureDrupalWebServer\",\n        \"remediationGuidance\": \"Insecure versions of Drupal Web Server have vulnerabilities that can span from Cross-Site Scripting (XSS) to Remote Code Execution.\\n1. It is recommended to upgrade the asset flagged under this policy to the latest secure version of Drupal.\\n2. Other recommendations, after the Drupal server has been updated, would be to move the asset flagged under this policy behind security tooling such as a Web Application Firewall (WAF) as well as enable appropriate logging and alerting.\\n3. More in-depth secure configuration guidance can be found on Drupal&#39;s site https://www.drupal.org/security/secure-configuration\"\n    },\n    {\n        \"issueTypeId\": \"InsecureEclipseJettyWebServer\",\n        \"remediationGuidance\": \"Versions 9.4.27, 9.4.28, and 9.4.29 of Eclipse Jetty are vulnerable to several CVEs ranging from denial of service vulnerabilites to local privilege escalation.\\n1. It is recommended to upgrade to the latest secure version of Eclipse Jetty in order to remediate these vulnerabilities.\\n2. More information regarding security bulletins from Eclipse Jetty, as well as appropriate fix versions for the vulnerabilities, can be found https://www.eclipse.org/jetty/security_reports.php.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureEximMailTransferAgent\",\n        \"remediationGuidance\": \"To secure Exim Mail Transfer Agent instances, it is recommended to perform the following:\\n\\n1. Isolate Exim Mail Transfer Agent instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Exim Mail Transfer Agent instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Exim Mail Transfer Agent instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Exim Mail Transfer Agent instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureFatPipeIPVPN\",\n        \"remediationGuidance\": \"Certain FatPipe IPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to identify the asset owner.\\n2. Work to patch the device to the latest secure version.\\n3. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\\n4. Further information regarding the vulnerability can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2021-27855.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureFatPipeMPVPN\",\n        \"remediationGuidance\": \"Certain FatPipe MPVPN devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to identify the asset owner.\\n2. Work to patch the device to the latest secure version.\\n3. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\\n4. Further information regarding the vulnerability can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2021-27855.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureFatPipeWARP\",\n        \"remediationGuidance\": \"Certain FatPipe WARP devices are currently affected by CVE-2021-27855, a high impact vulnerability that allows threat actors to breach companies and gain access to their internal networks.\\n\\nIt is recommended to perform the following:\\n1. Investigate the flagged device to identify the asset owner.\\n2. Work to patch the device to the latest secure version.\\n3. More information regarding vulnerable versions and impact can be found on the published FBI flash alert https://www.ic3.gov/Media/News/2021/211117-2.pdf.\\n4. Further information regarding the vulnerability can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2021-27855.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureFortraGoAnywhereManagedFileTransfer\",\n        \"remediationGuidance\": \"Fortra GoAnywhere Managed File Transfer (MFT) has been affected by numerous security vulnerabilities, including CVE-2023-0669. There are a number of steps that should be taken to ensure your organization remains secure.\\n\\n1. Determine if this asset must be publicly accessible. If there is not clear business need for this file transfer system to be publicly accessible (for example, if it were solely used for internal use) consider removing the service from the public internet.\\n2. Upgrade MFT to version 7.1.2 or later.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureGlobalscapeEFT\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Globalscape EFT instance, they could potentially steal sensitive data being transferred through the system, modify or delete files, and even gain access to other systems connected to the EFT instance.\\nVersions of Globalscape EFT identified by this policy are 8.0.x up to 8.1.0.14 which are vulnerable to the following CVEs:\\n* CVE-2023-2989 - Auth Bypass\\n* CVE-2023-2990 - Denial of Service\\n* CVE-2023-2991 - Remote Hard Drive Serial Number Disclosure\\n\\nIn order to remain secure, it is recommended to update the Globalscape EFT instance to the latest secure version.\\n\\nFor more broad remediation guidance, the following can be performed to remain secure:\\n1. Ensure that the EFT instance is running the latest version with all necessary patches and updates.\\n2. Configure the EFT instance to use secure protocols such as SFTP or HTTPS.\\n3. Implement strong password policies and enable two-factor authentication.\\n4. Configure firewalls and network access controls to limit access to the EFT instance to only authorized users and systems.\\n5. Implement monitoring and logging to detect and alert on any suspicious activity.\\n6. Regularly review and analyze logs and alerts to identify potential security issues.\\n7. Conduct regular vulnerability scans and penetration testing to identify potential vulnerabilities and security gaps.\\n8. Ensure that all employees are trained on secure file transfer practices, including how to detect and report suspicious activity.\\n9. Implement security information and event management (SIEM) tools to aggregate and analyze security events across the organization.\\n10. Implement encryption for data at rest and in transit to protect sensitive information from unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureGoogleWebFrameworkAngular\",\n        \"remediationGuidance\": \"This policy flags versions that have a vulnerability in the Comment Handler, as captured by https://nvd.nist.gov/vuln/detail/CVE-2021-4231. The Comment Handler does not perform appropriate security checks on user input, which could enable an attacker to engage in a cross-site scripting attack.\\n\\nIf running a vulnerable version, Xpanse recommends upgrading your version of  Angular to 11.0.5 or 11.1.0-next.3.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureGrafana\",\n        \"remediationGuidance\": \"Grafana is vulnerable to a number of critical vulnerabilities, such as CVE-2022-31107, CVE-2022-26148, and CVE-2023-3128, which can lead to authentication bypass and exposed passwords.\\n1. Update Grafana to the latest secure version.\\n2. Validate that the information displayed in Grafana should be publicly accessible. If not, work with the asset owner to remove the Grafana instance from the public internet.\\n3. For in-depth vendor recommendations, visit https://grafana.com/go/webinar/grafana-security-features/.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureGrandstreamNetworksUCM6200SeriesDevice\",\n        \"remediationGuidance\": \"Exploitation of CVE-2020-5722 can lead to executing shell commands as root on the affected device.\\n\\n1. It is recommended to upgrade the device to the latest secure version.\\n2. More information regarding CVE-2020-5722 can be found on the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2020-5722.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureHclBigFixPlatform\",\n        \"remediationGuidance\": \"It is recommended to upgrade the affected asset&#39;s version of BigFix Platform to either 9.5.20 or 10.0.7.\\nMore information can be found on the advisory released by HCL https://support.hcltechsw.com/csm?id&#61;kb_article&amp;sysparm_article&#61;KB0098998.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureHikvisionDevice\",\n        \"remediationGuidance\": \"CVE-2021-36260 is a command injection vulnerability found in Hikvision products. Utilizing this vulnerability, an attacker could use the flagged asset as an entry point into your network.\\n1. It is recommended to upgrade the firmware of the flagged asset to the latest secure version to ensure the vulnerability is patched.\\n2. The advisory released by Hikvision, as well as information regarding specifics around affected and resolved firmware versions, can be found https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/security-notification-command-injection-vulnerability-in-some-hikvision-products/\"\n    },\n    {\n        \"issueTypeId\": \"InsecureIBMCognosAnalytics\",\n        \"remediationGuidance\": \"Public facing instances of IBM Cognos Analytics are at far greater risk for exploitation due to multiple vulnerabilities and\\n common attack methodologies. Additionally, hosting this service on your public facing infrastructure increases you attack surface and should be avoided if possible. Xpanse recommends restricting access to your IBM Cognos Analytics application by taking the following steps:\\n\\n1. If your organization\u2019s IBM Cognos Analytics service must be public facing due to your network architecture place the hosting device behind a firewall and configure it to accept connections from known good IP addresses/subnets. Connections should be blocked from IP addresses not designated in your allow-list.\\n\\n2. Block all unexpected outbound network traffic to prevent potentially propagating confidential/sensitive data spills due to malware/exploits running on/against the system.\\n\\n3. Ensure you have the latest version of IBM Cognos Analytics deployed as all prior versions of the application to date have been noted as vulnerable to multiple different attack methodologies. If updating is not an option see below:\\n\\n\\t* In response to  https://exchange.xforce.ibmcloud.com/vulnerabilities/227591 ensure email communications to the hosting entity are filtered or blocked entirely. This can be done via port filtering on ports 25, 465, 995, 110, 993, and 143.\\n\\n\\t* In response to https://exchange.xforce.ibmcloud.com/vulnerabilities/233571 configure WAF rules to block POST requests containing .XML files. Additionally, if possible configure IBM Cognos Analytics to either not accept XML files or to not parse/accept external XML entities. These can be identified by the keyword SYSTEM under a defined entity.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureIgniteRealtimeOpenfire\",\n        \"remediationGuidance\": \"Versions of Ignite Realtime Openfire identified by this policy are vulnerable to CVE-2023-32315, an administrative console authentication bypass vulnerability. This attack can permit an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.\\n\\nIt is recommended to update the affected instance to the latest secure version in order to remediate the vulnerability.\\n\\nFor more broad security recommendations, it is recommended to perform the following:\\n1. Configure secure communication using SSL/TLS to encrypt communication between the Openfire server and clients, preventing unauthorized access to sensitive information.\\n2. Implement access controls, such as role-based access control (RBAC), to restrict access to the server and its resources to authorized users only, reducing the risk of unauthorized access or data breaches.\\n3. Configure firewall rules to restrict incoming and outgoing traffic to necessary ports and protocols, preventing malicious traffic from reaching the server and limiting the attack surface.\\n4. Set strong authentication policies, including password complexity requirements, multi-factor authentication, and regular password expiration, to ensure that user accounts are secure and protected from brute-force attacks and other forms of unauthorized access.\\n5. Monitor system logs for suspicious activity and set up alerts for potential security incidents, enabling quick detection and response to potential threats.\\n6. Conduct regular security audits to identify and remediate vulnerabilities, ensuring that the Openfire server and associated systems remain secure over time.\\n7. Keep the Openfire server and associated software up-to-date with the latest security patches and updates, ensuring that any known vulnerabilities are addressed in a timely manner.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureJoomlaCore\",\n        \"remediationGuidance\": \"CVE-2023-23754 and CVE-2023-23755 can lead to attackers gaining access to private information. Therefore, the following steps should be taken in order to remain secure:\\n\\n1. Immediately upgrade to the latest secure version of Joomla! Core. CVE-2023-23754 and CVE-2023-23755 require an upgrade to version 4.3.2 or higher.\\n2. Evaluate whether this web server must be accessible on the public internet. If not, place the device behind a VPN or restrict access to approved devices.\\n\\nA full list of the latest security issues impacting Joomla! Core can be found on the https://developer.joomla.org/security-centre.html.\"\n    },\n    {\n        \"issueTypeId\": \"InsecurejQueryUI\",\n        \"remediationGuidance\": \"This policy flags jQuery UI instances susceptible to CVE-2022-31160, a cross-site scripting (XSS) vulnerability. To remain secure, consider the following:\\n\\n1. Upgrade jQuery UI to version 1.13.2 or greater.\\n2. Given jQuery UI has disclosed vulnerabilities involving XSS, Palo Alto Networks recommends enforcing strict input sanitation measures on webpages built with jQuery UI to prevent similar exploits.\\n3. Ensure monitoring is configured to detect attacks such as cross-site scripting, cross-site request forgery, SQL injection, and other nefarious activities.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureLiferayPortal\",\n        \"remediationGuidance\": \"If you have identified an exposed and vulnerable instance of Liferay Portal, it is crucial to take immediate action to remediate the issue to prevent any potential security breaches. Here are some steps you can follow to remediate the issue:\\n\\n1. Quarantine the device from the network and other devices to prevent any further compromsise or lateral movement.\\n2. Analyze the device and any available logs to determine if a compromise took place. If a compromise is discovered take the necessary steps to contain, eradicate, and remediate all impacted devices.\\n3. Once you have identified the vulnerability, you should apply the necessary patches or updates to your Liferay Portal instance. Liferay typically releases security patches for known vulnerabilities, so make sure to check their website for the latest updates.\\n4. Review your security posture and make sure that your Liferay Portal instance is configured correctly. This includes reviewing access controls, user permissions, and other security devices in your network.\\n5. Monitor your Liferay Portal instance for any suspicious activity, such as unauthorized access attempts or unusual traffic patterns.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureLiteSpeedWebServer\",\n        \"remediationGuidance\": \"Although LiteSpeed comes with powerful out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing. Unit42 identified three new vulnerabilities in LiteSpeed Web Server in November 2022 and has detailed vulnerable versions in their https://unit42.paloaltonetworks.com/openlitespeed-vulnerabilities/.\\n\\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\\n\\n1. Validate the current running versions of LiteSpeed Enterprise in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\\n2. Review the current LiteSpeed configuration(s) against the https://www.litespeedtech.com/docs/webserver/config to prevent misconfigurations that could lead to leaking sensitive data.\\n3. Consider using LiteSpeed\u2019s built-in WAF features to detect and filter malicious traffic.\\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings.\\n\\nFor more detailed configuration information, please see the vendor\u2019s https://www.litespeedtech.com/docs/webserver.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureMicrosoftExchangeServer\",\n        \"remediationGuidance\": \"1. To identify the version and build of Exchange follow this guidance from Microsoft.  https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view&#61;exchserver-2019\\n2. For end of life (EOL) versions of Exchange best practice is to immediately remove access to the internet as they no longer receive security updates and pose a significant security risk to the environment.\\n3. For Exchange servers that are not end of life, best practice is to utilize Microsoft\u2019s Best Practice Analyzer (BPA) and evaluate the results against internal policy and Microsoft\u2019s best practices for Exchange.\\n4. Microsoft offers Best Practice Analyzer (BPA) a tool that should be leveraged to scan existing Exchange servers for patching, security, and compliance to Microsoft Best Practices.  https://docs.microsoft.com/en-us/windows-server/administration/server-manager/run-best-practices-analyzer-scans-and-manage-scan-results\\n\\nFor recommendations on CVE-2022-41040 and CVE-2022-41082, refer to the following guidance document released by Microsoft found https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/.\\nThis remediation guidance will be updated as more information becomes available.\\n\\nFor more information on CVE-2022-41080 and CVE-2022-41082, refer to the following post from Microsoft found https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-8-2022-kb5019758-2b3b039b-68b9-4f35-9064-6b286f495b1d\"\n    },\n    {\n        \"issueTypeId\": \"InsecureMicrosoftIisWebServer\",\n        \"remediationGuidance\": \"1. End of life (EOL) and outdated versions of software no longer get security updates on a regular basis and are a prime target for attackers. It is recommended to upgrade to a supported version of Microsoft IIS Web Server and apply latest security updates from Microsoft. Supported versions can be found at https://docs.microsoft.com/en-us/lifecycle/products/internet-information-services-iis\\n2. It is recommended to upgrade to the latest supported version and follow Microsoft IIS Web Server best practices. https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/iis-best-practices/ba-p/1241577\\n3. Microsoft offers Best Practice Analyzer (BPA) a tool that should be leveraged to scan IIS servers for patching, security, and compliance to Microsoft Best Practices.  https://docs.microsoft.com/en-us/windows-server/administration/server-manager/run-best-practices-analyzer-scans-and-manage-scan-results\"\n    },\n    {\n        \"issueTypeId\": \"InsecureMobileIronCore\",\n        \"remediationGuidance\": \"If you have identified an exposed and vulnerable instance of IVanti EPMM, formerly MobileIron Core, here are the steps you can take to remediate the exposed instance:\\n\\n1. Immediately isolate the vulnerable instance from the network to prevent further damage.\\n2. Download and install the latest security patches for MobileIron Core. \\n3. Conduct an investigation on the system to determine if a compromise took place. If a compromise took place determine the impact and take appropriate eradication and remediation steps to address the compromise.\\n4. Change all default passwords and ensure that all user accounts have strong passwords.\\n5. Monitor the system continuously for any suspicious activity and take immediate action if any security breaches are detected.\\n\\nAdditional Information: https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language&#61;en_US\"\n    },\n    {\n        \"issueTypeId\": \"InsecureMobileIronSentry\",\n        \"remediationGuidance\": \"This issue identifies insecure versions of MobileIron Sentry, specifically versions 9.18 and earlier which are vulnerable to CVE-2023-38035 as well as other CVEs. The vulnerability allows unauthenticated, remote attackers to access some sensitive APIs that are used to configure Ivanti Sentry on the administrator portal (MICS). As a best practice, it is recommended to update to the latest available version whenever possible.\\n\\nFor more broad remediation guidance, it is recommended to perform the following:\\n1. Isolate the exposed instance from the network to prevent further damage.\\n2. Assess the extent of the exposure and determine what data has been compromised.\\n3. Identify the root cause of the exposure, such as a misconfiguration or a vulnerability.\\n4. Apply patches or updates to fix the vulnerability or misconfiguration.\\n5. Change all passwords and access keys associated with the exposed instance.\\n6. Conduct a thorough security audit to identify any other potential vulnerabilities or exposures.\\n7. Implement additional security measures such as multi-factor authentication, network segmentation, and access controls to prevent future exposures.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureNodeJs\",\n        \"remediationGuidance\": \"To remediate an exposed and vulnerable instance of Node.js, follow these steps:\\n\\n1. Quarantine the asset associated with the identification of this issue.\\n2. Review network, application, host, IPS/IDS, etc. logs to determine if a compromise of the system/application took place.\\n\\ta. If a compromise has been observed, identify the root cause of the intrusion.\\n\\tb. Take necessary steps to contain, eradicate, remediate, and prevent future intrusions.\\n3. Update your Node.js version to the latest stable release. This will ensure that you have the latest security patches and fixes.\\n4. Review your code and make sure it is secure. Use best practices for coding and security, such as input validation, output encoding, and access control.\\n5. Ensure you are using adequate security tools such as firewalls, intrusion detection systems, and antivirus software to protect your Node.js instance from attacks.\\n6. Monitor your Node.js instance for any suspicious activity or unauthorized access.\\n\\nMore information regarding CVEs that affect Node.js can be found via NVD https://nvd.nist.gov/vuln/search/results?form_type&#61;Basic&amp;results_type&#61;overview&amp;query&#61;cpe%3A2.3%3Aa%3Anodejs%3Anode.js&amp;search_type&#61;all&amp;isCpeNameSearch&#61;false\"\n    },\n    {\n        \"issueTypeId\": \"InsecureNoviSurvey\",\n        \"remediationGuidance\": \"NoviSurvey is vulnerable to numerous CVEs, such as CVE-2023-29492, a critical remote code execution vulnerability. To ensure best security practices are being followed:\\n\\n1. Remove this server from the public internet.\\n2. Upgrade to the latest secure version. To prevent CVE-2023-29492, upgrade to version 8.9.43676 or greater.\\n3. After upgrading to the latest secure version, evaluate whether this instance should be placed back on the external internet.\\n\\nFor more information, view the https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureOpenLiteSpeedWebServer\",\n        \"remediationGuidance\": \"Although OpenLiteSpeed comes with solid out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing.\\n\\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\\n\\n1. Validate the current running versions of OpenLiteSpeed in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\\n2. Review the current OpenLiteSpeed configuration(s) against the https://openlitespeed.org/kb/ols-configuration-examples/ to prevent misconfigurations that could lead to leaking sensitive data.\\n3. Consider using LiteSpeed\u2019s built-in WAF features to detect and filter malicious traffic.\\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureOpenSSH\",\n        \"remediationGuidance\": \"OpenSSH versions under 9.3 allow for methods of remote code execution, privilege escalation, information disclosure and modification, as well as denial of service. When using OpenSSH ensure the following:\\n\\n1. Backported versions require system access and cannot be done accurately from the Internet, it is recommended to verify vulnerabilities on the system through a change log or other means.\\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to a supported version of OpenSSH and apply latest security updates. Latest versions can be found at https://www.openssh.com/openbsd.html.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureOpenSSL\",\n        \"remediationGuidance\": \"OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. Outdated versions of OpenSSL are exploitable to multiple known vulnerabilities including CVE-2022-0778 that allows for Denial-of-Service (DoS).\\n1. Backported versions require system access and cannot be done accurately from the internet, it is recommended to verify vulnerabilities on the system through a change log or other means.\\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to a supported version of OpenSSL and apply latest security updates. Latest versions can be found at https://www.openssl.org/source/\\n3. Mitigation and update guidance can also be found https://www.openssl.org/docs/man3.0/man7/migration_guide.html\\n4. As more information regarding OpenSSL version 3.0.7 is released, this policy will be updated.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureOpenSSLCve20223602Cve20223786\",\n        \"remediationGuidance\": \"OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. OpenSSL versions 3.0.0 through 3.0.6 are vulnerable to a buffer overflow vulnerabilities CVE-2022-2062 and CVE-2022-3768. This may lead to remote code execution or denial-of-service.\\n\\n1. Backported versions require system access and cannot be done accurately from the internet. It is recommended to verify vulnerabilities on the system through a change log or other means.\\n2. It is recommended to upgrade to a supported version of OpenSSL and apply latest security updates. Latest versions can be found at https://www.openssl.org/source/.\\n3. This https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ contains impact and mitigation details.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureOraclePeopleSoftPeopleTools\",\n        \"remediationGuidance\": \"Oracle PeopleSoft PeopleTools when misconfigured and/or unpatched poses a security risk to your organization. Take the following steps to secure your instance of PeopleTools:\\n\\n1. Ensure your instance of PeopleTools is updated to the latest available version.\\n2. Place PeopleTools behind security tools such as a WAF.\\n3. Do not make access to PeopleTools public.\"\n    },\n    {\n        \"issueTypeId\": \"InsecurePHP\",\n        \"remediationGuidance\": \"Identify the server or service owner of the affected asset and perform the following:\\n\\nIf your version falls under End of Life (EOL):\\n1. Upgrade your PHP instance to a version that is actively supported\\n\\nIf your version receives security fixes but is still marked as insecure:\\n1. Upgrade to an actively supported PHP version\\n2. Upgrade to a PHP version that fixes the vulnerability your version falls under\\n\\nHelpful documentation on upgrading your instance (what has been depreciated or incompatibilities for older versions) can be found here: https://www.php.net/manual/en/migration80.php\"\n    },\n    {\n        \"issueTypeId\": \"InsecurePrimeTekPrimeFaces\",\n        \"remediationGuidance\": \"PrimeTek PrimeFaces version 5.x is vulnerable to CVE-2017-1000486 (a weak encryption flaw leading to remote code execution) and version 7.0.11 to CVE-2020-10544 (a cross-site scripting vulnerability).\\nTo secure the server, ensure you are using the latest version of PrimeTek PrimeFaces.\"\n    },\n    {\n        \"issueTypeId\": \"InsecurePulseSecurePulseConnectSecureVPN\",\n        \"remediationGuidance\": \"Unpatched and misconfigured Pulse Secure VPN Servers pose a serious security risk to any organization as severe vulnerabilities have been released including remote code execution (RCE) with a total of over 70 CVEs published for this device.\\n\\n1. Pulse Connect Secure VPN Servers should be patched as soon as possible to prevent active exploits from being successfully ran against these devices.\\n2. VPN servers should be configured to include verbose logging to identify activities such as compromised account logins, anomalous geolocation based logins, brute force activity, injection attacks, impossible logins, single IPs hitting multiple accounts, and more.\\n3. Ensure administration/backend portals for Pulse Connect Secure VPN are not publicly available.\\n4. Ensure your IR plan for reacting to incidents involving your Pulse Connect Secure VPN include the ability to terminate sessions for users and deploy countermeasures in a swift timely manner.\\n5. Based on your organization and the nature of it&#39;s business consider geolocation IP filtering for access to the user login interface.\\n6. Consider blocking known TOR exit node traffic.\\n7. If possible obfuscate the nature of the server/domain hosting Pulse Connect Secure VPNs by sanitizing applicable DNS records, server responses, and the domain name.\\n8. Pulse Secure VPN Best Practices https://docs.pulsesecure.net/WebHelp/PDC/Migration%20Guides/NC_to_PDC/Content/Links_Network_Connect_to_Pulse_Desktop_Client_Migration_Guide/Considering_Best_Practices.htm.\"\n    },\n    {\n        \"issueTypeId\": \"InsecurePythonApplication\",\n        \"remediationGuidance\": \"Insecure versions of Python are associated with various vulnerabilities such as access control bypass or remote code execution.\\n\\nIt is recommended to identify the asset owner and work with them to perform any of the following:\\n1. Update the version of Python used by the application to a newer, secure version.\\n2. If the version of python cannot be updated, work to remove the application from the internet.\\n3. If the application cannot be removed from the internet, it is recommended to put the application behind a Web Application Firewall (WAF) or similar tool to help mitigate any attacks against the application.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureQuestKaceSystemManagementAppliance\",\n        \"remediationGuidance\": \"This policy flags instances of Quest KACE system management appliance that are vulnerable to CVE-2018-11138, a remote code execution vulnerability.\\nIn order to remediate this vulnerability, it is recommended to upgrade the system to the latest secure version (above 8.0.318).\\nThe CVE entry in NIST&#39;s National Vulnerability Database can be found https://nvd.nist.gov/vuln/detail/CVE-2018-11138\"\n    },\n    {\n        \"issueTypeId\": \"InsecureRoundcubeWebmail\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Roundcube Webmail server, they could potentially compromise the entire email system, affecting multiple users and accounts. This could lead to unauthorized access to sensitive information, personal data, and contacts of all users on the server.\\n\\nIn order to remediate versions of Roundcube Webmail that are identified through this policy, the most important thing that can be done is to update to the latest secure version.\\n\\nFor more remediation guidance for Roundcube Webmail, see below:\\n1. Regularly update the Roundcube Webmail software, plugins, and underlying server software to ensure that all known vulnerabilities are patched.\\n2. Implement strong authentication mechanisms such as multi-factor authentication (MFA) and enforce the use of strong, unique passwords for all user accounts.\\n3. Configure firewalls and access control lists (ACLs) to restrict incoming and outgoing traffic to the Roundcube Webmail server, allowing only necessary and trusted connections.\\n4. Enable encryption (e.g., SSL/TLS) for both data in transit and at rest to protect sensitive information from unauthorized access and tampering.\\n5. Perform regular security audits, vulnerability assessments, and monitor server logs to detect and respond to potential threats, unauthorized access, or suspicious activity in a timely manner.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureRubyOnRails\",\n        \"remediationGuidance\": \"CVE-2016-2098 allows remote attackers to execute arbitrary Ruby code by leveraging an application&#39;s unrestricted use of the render method for versions before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2. The vendor recommends updating to the latest version of Ruby on Rails.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSecurityAndInfrastructureTechnologies\",\n        \"remediationGuidance\": \"1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\\n\\n2. Security and infrastructure are common targets for cyber criminals. Ensure that monitoring is enabled to detect abnormal traffic.\\n\\n3. If applicable, upgrade the device to the latest secure version.\\n\\n4. Check vendor recommendations for configuring and maintaining the service. If possible, set up monitoring for vendor security advisories.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSignatureCertificate\",\n        \"remediationGuidance\": \"The use of weak algorithms is discouraged and presents security risks to organizations. It is recommended to use cipher suites that are considered secure such as SHA256, SHA384, SHA512, and ECDSA.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSipServer\",\n        \"remediationGuidance\": \"Secure your SIP servers by taking the following precautions:\\n\\n1. This policy specifically flags SIP configurations that have enabled the OPTIONS method. It is recommended to disable this method unless absolutely necessary, because it allows attackers to gain information about a system and craft specific attack plans against a SIP device.\\n2. Maintain SIP systems behind a firewall or through a VPN.\\n3. If the SIP server needs to be exposed to the Internet, then using high-entropy passwords, lockout policy, and traffic inspection is recommended.\\n4. Ensure that usernames are not based on extensions since most brute force attacks will attempt an extension match.\\n\\nFurther documentation:  https://datatracker.ietf.org/doc/html/rfc3261#section-26.3\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSolarWindsOrionPlatform\",\n        \"remediationGuidance\": \"The SolarWinds breach was a multi-part, sophisticated attack that involved the distribution of the SUNBURST backdoor. SUNBURST is a digitally signed malware that was embedded into a SolarWinds plugin, allowing attackers to move laterally within an organization\u2019s network when the backdoor is executed. The impacted versions are 2019.4 HF 5,2020.2 with no patch installed or 2020.2 HF 1. If any of those versions are running, upgrading to 2020.2.1 HF 2 or above is imperative.\\n\\nSince SUNBURST is digitally signed and looks legitimate, assessing the impact of this intrusion could be complex. Follow CISA\u2019s recommended process for remediating malicious activity caused by SUNBURST. Your organization can also investigate potential SUNBURST activity using the https://unit42.paloaltonetworks.com/atoms/solarstorm/\\n\\nFurther documentation:  https://www.cisa.gov/uscert/ncas/current-activity/2021/03/09/guidance-remediating-networks-affected-solarwinds-and-active.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSolarWindsServU\",\n        \"remediationGuidance\": \"In order to protect against CVE-2021-35211, in addition to other security vulnerabilities, ensure that SolarWinds Serv-U is running version 15.2.3 HF2 or later.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSonicWallSonicOS\",\n        \"remediationGuidance\": \"Assets identified by this policy may be vulnerable to CVE-2020-5135, a vulnerability allowing a remote attacker to cause a Denial of Service (DoS).\\nXpanse recommends identifying the affected asset or server owner and work with them to upgrade the version of SonicWall SonicOS to the latest secure version.\\nMore details regarding the vulnerability can be found at the NIST NVD entry https://nvd.nist.gov/vuln/detail/CVE-2020-5135\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSumavisionRouterEnhancedMultimediaRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureSynologyVPNPlusServer\",\n        \"remediationGuidance\": \"VPN clients should be monitored closely, as they can provide threat actors a foothold into an organization&#39;s network. Synology VPN Plus Server comes equipped with a number of different settings that can help secure the device:\\n\\n1. Upgrade to the latest secure version. For CVE-2022-43931, upgrade the device to version 1.4.3-0534 or 1.4.4-0635.\\n2. Utilize VPN Plus Server&#39;s traffic monitoring functionality. Setup alerts that trigger on suspicious behavior.\\n3. Carefully manage user permissions, and limit access to the VPN only to trusted users.\\n4. Work with IT to ensure this device is using a secure protocol. Certain protocols may require more maintenance than others. For instance, it is recommended to not use PPTP due to security concerns.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureTelerikWebUI\",\n        \"remediationGuidance\": \"When left unpatched or misconfigured, Telerik Web UI components pose a serious security risk due multiple CVEs, such as CVE-2019-18935, which can lead to arbitrary file inclusion, arbitrary code execution, cross-site scripting, and directory traversal.\\n\\n1. Ensure your organization is running the latest updates for Telerik to prevent known/active exploits from being successfully ran against your Telerik based web UI components.\\n2. Enable robust application and server logging to monitor for nefarious activities such as file inclusions, cross-site scripting, and arbitrary code execution.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureTibcoJasperServer\",\n        \"remediationGuidance\": \"TIBCO JasperServer is vulnerable to a number of CVEs, including CVE-2018-5430 and CVE-2018-18809, two improper path traversal vulnerabilities. Exploitation could lead to a threat actor viewing arbitrary files on the server. To best protect your organization:\\n1. Configure the security settings in TIBCO JasperServer to restrict access to sensitive data and features. For example, limit user access to reports and dashboards based on their roles and responsibilities.\\n2. Implement security best practices, such as strong passwords, two-factor authentication, and regular security audits. Train users on how to recognize and report security incidents.\\n3. Monitor your TIBCO JasperServer instance for any unusual activity or signs of a security breach. Use logging and monitoring tools to track user activity and detect potential threats.\\n4. Upgrade to the latest secure version of JasperServer.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureTLS\",\n        \"remediationGuidance\": \"Insecure versions of TLS are versions that are known to be crackable and are therefore unsafe to utilize.\\n1. It is recommended to identify the asset owner of the device flagged through this policy and work to disable insecure versions of TLS.\\n2. More information regarding detection, remediation, configuration and various tools for identification can be found at the NSA Github repository https://github.com/nsacyber/Mitigating-Obsolete-TLS\"\n    },\n    {\n        \"issueTypeId\": \"InsecureTLSStrict\",\n        \"remediationGuidance\": \"Disabling older and deprecated versions of protocols reduces the attack surface, and is recommended as a best practice for Internet facing targets.\\nIt is recommended to identify all assets that utilize deprecated SSL/TLS configurations and upgrade to cipher suites that are considered secure.\\n\\nFollow additional guidance set forth by NIST as needed:\\nhttps://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final\"\n    },\n    {\n        \"issueTypeId\": \"InsecureWebApplications\",\n        \"remediationGuidance\": \"1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\\n\\n2. If applicable, upgrade the web server to the latest secure version.\\n\\n3. Check vendor recommendations for configuring and maintaining the web application. If possible, set up monitoring for vendor security advisories.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureWebFrameworksAndLibraries\",\n        \"remediationGuidance\": \"1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\\n\\n2. If applicable, upgrade the framework or library to the latest secure version.\\n\\n3. When possible, refrain from using public CDNs to serve libraries.\\n\\n4. Check vendor recommendations for configuring and maintaining the web frameworks, libraries, and third-party services. If possible, set up monitoring for vendor security advisories.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureWebServerTechnologies\",\n        \"remediationGuidance\": \"1. Determine if this asset should be accessible on the public internet. If this asset should not be publicly accessible, identify the asset owner and work with them to restrict access. If the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\\n\\n2. If applicable, upgrade the web server to the latest secure version.\\n\\n3. Check vendor recommendations for configuring and maintaining the web server. If possible, set up monitoring for vendor security advisories.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureZohoManageEnginePasswordManagerPro\",\n        \"remediationGuidance\": \"Builds of Zoho ManageEngine Password Manager Pro that are flagged by this policy are vulnerable to CVE-2022-35405; a remote code execution vulnerability.\\nIt is recommended to upgrade the flagged asset to build 12101 or later.\\nThe vendor advisory regarding this vulnerability can be found https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html.\"\n    },\n    {\n        \"issueTypeId\": \"InsecureZohoManageEngineServiceDeskPlus\",\n        \"remediationGuidance\": \"1. Evaluate if ManageEngine ServiceDesk Plus should be directly accessible from the internet.  Apart from rare circumstances, ManageEngine ServiceDesk Plus should be deployed on an internal network.\\n2. The Zoho ManageEngine ServiceDesk Plus Admin Guide gives detailed installation instructions.  This includes how to install certificates, manage users, and log connections.\\n3. Follow the Best Practices to help secure the application: https://download.manageengine.com/products/service-desk/servicedesk-plus-installation-best-practices-guide.pdf\"\n    },\n    {\n        \"issueTypeId\": \"IntelActiveManagementTechnology\",\n        \"remediationGuidance\": \"Exploitation of Intel Active Management Technology via CVE-2022-28697 and CVE-2022-30601 can lead to privilege escalation, while CVE-2022-30944 can lead to information disclosure.\\nIt is recommended to follow the steps provided by Intel to address these CVEs: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html.\"\n    },\n    {\n        \"issueTypeId\": \"InternalIPAddressAdvertisement\",\n        \"remediationGuidance\": \"Internal IP addresses (RFC 1918) should be obscured by firewalls or proxy servers. When leaked on the internet they provide potential attackers with a probable entry point.\\n\\n1. Internal IP addresses should not be visible from the internet.\\n2. Identify the device that is leaking private internal IP addresses and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n3. Verify device configurations and ensure internal IP addresses are not being broadcast.\"\n    },\n    {\n        \"issueTypeId\": \"InvalidCertificateChain\",\n        \"remediationGuidance\": \"In order to ensure the server is secure and available to users with different SSL implementations:\\n1. Verify that each certificate in the chain is signed by the certificate after it.\\n2. Correctly order the certificate chain. According to https://www.rfc-editor.org/rfc/rfc4346#section-7.4.2, certificate chains should be in descending order.\\n3. Remove unnecessary certificates.\"\n    },\n    {\n        \"issueTypeId\": \"JenkinsServer\",\n        \"remediationGuidance\": \"Mis-configured Jenkins servers may disclose sensitive information such as credentials and log files. To reduce the likelihood of such instances, verify the following:\\n\\n1. Verify that the Jenkins server is properly configured. Instructions on how to do so can be found at https://www.jenkins.io/doc/book/installing/initial-settings/.\\n2. Best practice is to ensure Jenkins server is not publicly accessible on the Internet and only on trusted local networks.\\n3. Ensure the Jenkins and plugins are up to date, information on how to do so can be found at https://www.jenkins.io/doc/book/managing/plugins/ and https://www.jenkins.io/download/.\\n4. Review user permissions, specifically for JENKINS_HOME directory and build pipelines, and evaluate if all users must be included. Further, ensure users cannot elevate their permissions. There are various Jenkins plugins that can aid in doing so.\\n5. Ensure credentials are securely stored. There are various Jenkins plugins that can aid in doing so.\"\n    },\n    {\n        \"issueTypeId\": \"jQueryUI\",\n        \"remediationGuidance\": \"Unpatched and misconfigured jQuery UI poses a serious security risk to any organization. Severe vulnerabilities have been discovered which can lead to cross-site scripting (XSS).\\n\\n1. Given jQuery UI has disclosed vulnerabilities involving XSS, Palo Alto Networks recommends enforcing strict input sanitation measures on webpages built with jQuery UI to prevent similar exploits.\\n\\n2. Ensure monitoring is configured to detect attacks such as cross-site scripting, cross-site request forgery, SQL injection, and other nefarious activities.\"\n    },\n    {\n        \"issueTypeId\": \"KaseyaVSA\",\n        \"remediationGuidance\": \"On July 3, 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) advised organizations to shut down all VSA servers as REvil ransomware began exploiting a zero day in Kaseya VSA to propagate ransomware.\"\n    },\n    {\n        \"issueTypeId\": \"Kubernetes\",\n        \"remediationGuidance\": \"The Kubernetes control plane (also called API server) should not be directly accessible from the internet as they pose a serious security risk to any organization\\n as severe vulnerabilities have been released. \\n\\n1. Identify the exposed Kubernetes server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Ensure that Kubernetes is configured to use TLS and Role Based Access Controls (RBAC). If for some reason the Kubernetes server must be exposed to the internet leverage MFA and place the server behind a Web Application Firewall (WAF).\\n3. Kubernetes security best practices can be followed https://kubernetes.io/docs/concepts/security/\"\n    },\n    {\n        \"issueTypeId\": \"LDAPServer\",\n        \"remediationGuidance\": \"Exposed LDAP servers are vulnerable to various attack vectors, including LDAP injection, directory spoofing, and denial-of-service (DoS) attacks, which could lead to significant service interruptions or malicious actors gaining access to sensitive information.\\n\\nXpanse recommends taking the following steps to secure LDAP servers:\\n\\n1. Implement input sanitization and validation to prevent malicious code injection.\\n2. Implement robust access control policies that follow the principle of least privilege.\\n3. Enable TLS to protect data integrity.\\n4. Automate identity provisioning and de-provisioning to prevent stale users and their associated credentials from being used in an insider threat attack.\\n5. Place LDAP servers behind a VPN so that they\u2019re no longer publicly accessible.\\n6. Implement comprehensive monitoring and logging of LDAP operations to identify potential attacks\"\n    },\n    {\n        \"issueTypeId\": \"LiferayDigitalExperiencePlatform\",\n        \"remediationGuidance\": \"If you have identified an exposed and vulnerable instance of Liferay Digital Experience Platform (DXP), you should take immediate action to remediate the issue to prevent any potential security breaches. Here are the steps you can follow to remediate the issue:\\n\\n1. Disconnect the device from the network to prevent any potential further unauthorized access or exploit attempts.\\n2. Review the system and its available logs to determine if any compromise took place on the system.\\n3. Check if there are any available security patches or updates for your version of Liferay DXP. If there are, install them immediately to eliminate any known vulnerabilities.\\n4. If you are using default credentials for your Liferay DXP instance, change them immediately to strong, unique passwords.\\n5. If your instance of Liferay DXP must be public facing ensure it sits behind the appropriate security controls and that security best practices such as SSL/TLS encryption, MFA, and other restrictions are in place.\\n6. Perform regular vulnerability scanning to identify any potential security issues in your Liferay DXP instance.\\n7. Monitor your Liferay DXP instance for any suspicious activity, such as unauthorized access attempts or unusual traffic patterns. Additional information on how to secure your instance of Liferay DXP can be found https://learn.liferay.com/w/dxp/installation-and-upgrades/securing-liferay\"\n    },\n    {\n        \"issueTypeId\": \"LiferayPortal\",\n        \"remediationGuidance\": \"If attackers gain access to a publicly exposed Liferay portal instance, critical information could be leaked.\\n\\nTo secure Liferay Portal instances, it is recommended to perform the following:\\n\\n1. Isolate Liferay Portal instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Liferay Portal instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Liferay Portal instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Liferay Portal instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"LiteSpeedWebServer\",\n        \"remediationGuidance\": \"Although LiteSpeed comes with powerful out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing. Unit42 identified three new vulnerabilities in LiteSpeed Web Server in November 2022 and has detailed vulnerable versions in their https://unit42.paloaltonetworks.com/openlitespeed-vulnerabilities/.\\n\\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\\n\\n1. Validate the current running versions of LiteSpeed Enterprise in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\\n2. Review the current LiteSpeed configuration(s) against the https://www.litespeedtech.com/docs/webserver/config to prevent misconfigurations that could lead to leaking sensitive data.\\n3. Consider using LiteSpeed\u2019s built-in WAF features to detect and filter malicious traffic.\\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings.\\n\\nFor more detailed configuration information, please see the vendor\u2019s https://www.litespeedtech.com/docs/webserver.\"\n    },\n    {\n        \"issueTypeId\": \"Log4ShellVulnerableVMwareWorkspaceOneAccessServer\",\n        \"remediationGuidance\": \"Log4j is a popular java logging library. In late 2021, a critical exploit called Log4Shell was discovered that could potentially lead to arbitrary code execution. To protect against the Log4Shell exploit:\\n\\n* Determine if this instance of VMware Workspace ONE Access must be accessible on the public internet. If not, work with the asset owner to limit access.\\n* Upgrade to the latest secure version.\"\n    },\n    {\n        \"issueTypeId\": \"LongExpirationCertificate\",\n        \"remediationGuidance\": \"1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \\n2. Identify all existing certificates and their expiration dates. For certificates with a validity period greater than 397 days follow established procedure to revoke and replace the certificate.\\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions. https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html\"\n    },\n    {\n        \"issueTypeId\": \"Mattermost\",\n        \"remediationGuidance\": \"If an instance of Mattermost is unintentionally exposed, it is important to take immediate steps to remediate the issue to prevent unauthorized access or data breaches. Here are some steps that can be taken:\\n\\n1. Disconnect the server from the internet to prevent further access.\\n2. Change all passwords and access keys associated with the instance of Mattermost.\\n3. Investigate the cause of the exposure. Determine if any vulnerabilities were exploited or if any misconfigurations were present.\\n4. Patch any vulnerabilities and fix any misconfigurations identified during the investigation.\\n5. Perform a security audit of the system to ensure that it is properly secured.\\n6. If any data was compromised, notify affected users and take steps to mitigate any potential harm.\\n7. Once the issue has been resolved, determine a way to safely make the device accessible to users. One such way is placing it in your internal environment and allowing users to access the environment via a VPN.\\n\\nFor more information regarding security settings and configurations, please reference the vendor documentation found https://docs.mattermost.com/about/security.html.\"\n    },\n    {\n        \"issueTypeId\": \"MemcachedServer\",\n        \"remediationGuidance\": \"Memcached systems may contain sensitive information and should not be externally accessible as they are not hardened against external attack.\\nIt is recommended to remove the device from being publicly accessible from the internet.\\nOther configuration options that are useful for securing the Memcached system are:\\n1. Bind Memcached to a local interface\\n2. Disable UDP on the Memcached system (Disabling TCP on the public interface is also recommended but can cause issues with accessing resources outside of the internal network)\"\n    },\n    {\n        \"issueTypeId\": \"MetaPixel\",\n        \"remediationGuidance\": \"The original intent behind the development of the Meta Pixel was to improve users\u2019 advertising experience by comprehensively tracking their actions on websites and mapping that behavioral profile to customized, well-targeted advertising. Despite this innocuous intent, the Pixel has been involved in an increasing number of high-profile data breaches that led to PII and PHI data being accidentally leaked from healthcare systems, tax preparation websites, and education-related platforms.\\n\\nMeta Pixel breaches happen when the functions embedded in the Pixel collect sensitive user information (like medical information, IP address, address/location, etc.), which is then transmitted upstream to Meta, which will store and sell this data to advertisers. Since the Pixel is so easily misconfigured, having Meta Pixel configured on your organization\u2019s assets carries a significant risk of an unintended data breach that could violate HIPAA or privacy laws.\\n\\nDue to these concerns, Xpanse recommends removing the Meta Pixel from all assets flagged by this policy.\"\n    },\n    {\n        \"issueTypeId\": \"MicrofocusAccessManager\",\n        \"remediationGuidance\": \"To secure Microfocus Access Manager instances, it is recommended to perform the following:\\n\\n1. Isolate Microfocus Access Manager instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Microfocus Access Manager instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Microfocus Access Manager instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Microfocus Access Manager instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftDnsServer\",\n        \"remediationGuidance\": \"Microsoft DNS Servers can potentially be exploited in various ways with repercussions ranging from information disclosure to remote code execution (RCE).\\nMicrosoft has a free training module around securing Windows Server DNS that can be found https://learn.microsoft.com/en-us/training/modules/secure-windows-server-domain-name-system/.\"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftExchangeServer\",\n        \"remediationGuidance\": \"Due to the number and severity of recent vulnerabilities it is imperative to identify all on-premises Microsoft Exchange Servers and ensure they are fully patched and security hardened.\\n\\n1. To identify the version and build of Exchange follow this guidance from Microsoft https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view&#61;exchserver-2019.\\n2. For end of life (EOL) versions of Exchange best practice is to immediately remove access to the internet as they no longer receive security updates and pose a significant security risk to the environment.\\n3. For Exchange servers that are not end of life, best practice is to utilize Microsoft\u2019s Best Practice Analyzer (BPA) and evaluate the results against internal policy and Microsoft\u2019s best practices for Exchange.\\n4. Microsoft offers Best Practice Analyzer (BPA) a tool that should be leveraged to scan existing Exchange servers for patching, security, and compliance to Microsoft Best Practices. It can be found https://docs.microsoft.com/en-us/windows-server/administration/server-manager/run-best-practices-analyzer-scans-and-manage-scan-results.\"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftOWAServer\",\n        \"remediationGuidance\": \"1. Best practice is to ensure Multi Factor Authentication (MFA) is being used on Outlook Web Access (OWA) and Office365. Guidance from microsoft can be found here. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view&#61;o365-worldwide\\n2. If in use, verify Microsoft Exchanger Server is running supported versions and apply latest security updates from Microsoft. End of Life (EOL) and outdated versions of software no longer get security updates on a regular basis and are a prime target for attackers.\\n3. Permit Outlook Web Access and Office365 access only through a secure Virtual Private Network (VPN) connection. Guidance from Microsoft can be found here. https://docs.microsoft.com/en-us/microsoft-365/solutions/empower-people-to-work-remotely-remote-access?view&#61;o365-worldwide\\n4. Review group policies and evaluate if all users must be included in sensitive roles. \"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftRDPWebClient\",\n        \"remediationGuidance\": \"RDP attacks are one of the most common attack vectors, and they are known to lead to devastating breaches. RDP access is often sold on the dark web, and breaches can go undetected for a long time. A successful attack against the RDP web client could lead to malicious actors gaining unauthorized access to internal systems, running network reconnaissance, or, at a minimum, allowing them to collect sensitive information used later to stage a more significant, impactful attack.\\n\\nRecommendations to reduce the likelihood of malicious RDP attempts are as follows:\\n\\n1. A best practice is not to have RDP publicly accessible on the internet and instead only on trusted local networks.\\n2. Implement a risk-based approach that prioritizes patching RDP vulnerabilities with known weaponized public exploits.\\n3. Limit RDP access to a specific user group and implementing lockout policies is an additional measure to protect against RDP brute-forcing, which is another common tactic used by attackers. In addition, enable NLA (Network Level Authentication) which is non-default on older versions.\\n4. If remote access to RDP or terminal services is a business requirement, it should only be made accessible through a secure Virtual Private Network (VPN) connection with multi-factor authentication (MFA) to the corporate network or through a zero-trust remote access gateway.\"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftWindowsServer2000\",\n        \"remediationGuidance\": \"Microsoft Windows Server 2000 has not been supported by Microsoft since 2010 and it is no longer receiving security updates. It is recommended to upgrade to a newer versions of Windows Server.\"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftWindowsServer2003\",\n        \"remediationGuidance\": \"Due to extended support for Server 2003 ending on July 14, 2015 it is recommended to upgrade instances of Windows Server 2003 to either the latest version or one that is still receiving support (updates and security patches) from Microsoft or remove these assets from the internet entirely.\\nInformation on doing to can be found at https://docs.microsoft.com/en-us/windows-server/get-started/install-upgrade-migrate\"\n    },\n    {\n        \"issueTypeId\": \"MicrosoftWindowsServer2012R2\",\n        \"remediationGuidance\": \"Microsoft Windows Server 2012 R2 when left unpatched or misconfigured poses a serious security risk to your organization. Palo Alto Networks recommends the following remediation actions:\\n\\n1.Ensure your instance of Microsoft Windows Server 2012 R2 is on the latest version to reduce the risk of an exploit being successfully ran against this OS.\\n2.Ensure access to this resource is properly restricted by taking measures such as dual-homing the device and placing the login interface on the private IP address range only.\\n3.Place this device behind security devices in your network such as a WAF and enable robust logging on the asset.\"\n    },\n    {\n        \"issueTypeId\": \"MikroTikRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"MinIO\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed MinIO server, they can potentially compromise sensitive data stored within the server, such as personal information, confidential documents, or proprietary assets. The attacker may also alter, delete, or generally disrupt business operations.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Implement network segmentation by isolating the MinIO server behind a firewall, allowing only necessary traffic to reach the server.\\n2. Set up strong authentication and authorization mechanisms, such as access keys and bucket policies, to restrict access only to authorized users.\\n3. Regularly update the MinIO server software to ensure it&#39;s protected against known vulnerabilities and running the latest security features.\\n4. Enable encryption for data transmission (e.g., HTTPS) and storage (e.g., server-side or client-side encryption) to safeguard sensitive data from unauthorized access.\\n5. Monitor the MinIO server using logging and intrusion detection tools to detect and respond to suspicious activities, and routinely review access logs and server configurations to maintain security best practices.\\n\\nMore information regarding secure configurations and best practices can be found https://min.io/docs/minio/container/administration/identity-access-management.html\"\n    },\n    {\n        \"issueTypeId\": \"MisconfiguredCrossSiteProtections\",\n        \"remediationGuidance\": \"Cross-site scripting is a common, yet dangerous attack vector. There are a number of ways for websites to protect against cross-site scripting: \\n\\n1. Set the X-Frame-Options header to either DENY or SAMEORIGIN. Alternatively, set the Content-Security-Policy frame-ancestors directive. Setting this option will help prevent click-jacking. \\n\\n2. Set the X-Content-Type-Options header to nosniff. This prevents MIME type sniffing, which could lead to security concerns if the content-type is executable. \\n\\n3. The Content-Security-Policy (CSP) header mitigates certain XSS and data injection attacks. Details on how to configure a policy can be found on the https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#writing_a_policy. \\n\\n4. Permissions-Policy works similarly to CSP, and can be a great way to further secure specific elements of a webpage. Detailed documentation on how this header works can be found on the https://developer.mozilla.org/en-US/docs/Web/HTTP/Permissions_Policy. \\n\\n5. Cross-Origin Resource Sharing (CORS) specifies to a browser where it should load resources from. There are a number of HTTP headers based on CORS, including Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Allow-Credentials, Access-Control-Allow-Methods, Access-Control-Allow-Headers. For a full list of headers, and suggested configurations, visit the https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#the_http_response_headers.\"\n    },\n    {\n        \"issueTypeId\": \"MissingContentSecurityPolicyHeader\",\n        \"remediationGuidance\": \"Omitting Content Security Policy header leaves web servers vulnerable to data theft and data injection. To reduce the likelihood of such attempts, Xpanse suggests adding Content-Security-Policy (CSP) HTTP response headers to your web application. Information on how to do so can be found at https://content-security-policy.com/.\"\n    },\n    {\n        \"issueTypeId\": \"MissingStrictTransportSecurityHeader\",\n        \"remediationGuidance\": \"When HTTP Strict Transport Security (HSTS) is not enabled, threat actors can run SSL stripping attacks, making all web connections unencrypted. It is recommended to enable HTTP Strict Transport Security (HSTS) by following these steps:\\n\\n**1. Add a Strict-Transport-Security response header to your application** with the value: max-age&#61;31536000. This will inform the browser that it should not allow that web application to be accessed over HTTP during the configured time. The max-age should be set to at least one year.\\n**2. Add the includeSubDomains flag**, which will enforce HSTS at the subdomain level\\n**3. Consider submitting your application\u2019s domain to preload lists** to prevent SSL stripping attacks on first use. If any subdomains are expected to function over HTTP, preloading may not be a feasible solution as it will make those subdomains inaccessible.\\n\\nFurther documentation:  https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html\"\n    },\n    {\n        \"issueTypeId\": \"MissingXContentTypeOptionsHeader\",\n        \"remediationGuidance\": \"Identify the server or service owner of the flagged asset and perform the following:\\nSet the X-Content-Type-Options HTTP header in the server configuration of the flagged asset to &#34;nosniff&#34;.\\n\\nFor information on specific configurations or other secure headers to utilize, see the following:\\n1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options\\n2. https://owasp.org/www-project-secure-headers/\"\n    },\n    {\n        \"issueTypeId\": \"MissingXFrameOptionsHeader\",\n        \"remediationGuidance\": \"1. Best practice is to enable the X-Frame-Options header with the value DENY or SAMEORIGIN.\\n2. Evaluate the type of web server that is hosting the content with the missing X-Frame-Options header. Each web server has a slight configuration variation for X-Frame-Options headers. Mozilla has a good reference for each configuration.\\nhttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options\\n3. Along with the X-Frame-Options header, OWASP recommends a layered security approach. Leveraging a Content Security Policy (CSP),  SameSite cookies, or JavaScript \u201cFrame-Buster\u201d code will help provide defense in-depth. \\nhttps://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html\"\n    },\n    {\n        \"issueTypeId\": \"MissingXXssProtectionHeader\",\n        \"remediationGuidance\": \"Omitting the X-XSS-Protection header has the potential to leave web browsers vulnerable to XSS (Cross-Site Scripting) attacks. However, with modern browsers this can be mitigated with a strong Content-Security-Policy which disables the use of inline Javascript (&#39;unsafe-inline&#39;).\\n1. If you do not need to support older browsers, utilize Content-Security-Policy without allowing &#39;unsafe-inline&#39; scripts instead.\\n2. If you need to support older browsers, you can set this flag to any of the following depending on your need.\\n2a: X-XSS-Protection: 1\\n2b: This enables XSS filtering in the browser. The browser will render the page after the browser has sanitized the page if an attack is detected.\\n2c: X-XSS-Protection: 1; mode&#61;block\\n2d: This enables XSS filtering in the browser. The browser will prevent rendering of the page if an attack is detected.\\n2e: X-XSS-Protection: 1; report&#61; (Chromium only)\\n2f: This enables XSS filtering in the browser. The browser will render the page after the browser has sanitized the page if an attack is detected. The browser will then report the attack using the CSP &#39;report-uri&#39; directive to the reporting uri defined in the &#39;&#39; field above.\\n\\nFor more information on specific configurations and vulnerability information, please see the following:\\nhttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection\"\n    },\n    {\n        \"issueTypeId\": \"MitelMiCollab\",\n        \"remediationGuidance\": \"To secure Mitel MiCollab instances, it is recommended to perform the following:\\n\\n1. Isolate Mitel MiCollab instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Mitel MiCollab instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Mitel MiCollab instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Mitel MiCollab instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"MitelMiVoice\",\n        \"remediationGuidance\": \"If attackers gain access to a publicly exposed Mitel MiVoice Business Express instance, an organization\u2019s communication infrastructure could be breached and it could lead to leaks of sensitive proprietary information or could lead to significant communication interruptions.\\n\\nTo secure Mitel MiVoice Business Express instances, it is recommended to perform the following:\\n\\n1. Isolate Mitel MiVoice Business Express instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Mitel MiVoice Business Express instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Mitel MiVoice Business Express instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Mitel MiVoice Business Express instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"MobileIronCore\",\n        \"remediationGuidance\": \"To remediate an exposed instance of Ivanti Endpoint Manager Mobile, you should take the following steps:\\n\\n1. Immediately disconnect the affected system or network from the internet to prevent further unauthorized access or damage.\\n2. Assess the extent of the exposure and determine the potential impact on the system, network, and data.\\n3. Identify the cause of the exposure, such as a vulnerability or misconfiguration, and address it accordingly.\\n4. If a vulnerability caused the exposure, apply the appropriate security patch or update to the Ivanti Endpoint Manager Mobile software to fix the vulnerability.\\n5. Change all passwords and access credentials associated with the affected system or network.\\n6. Conduct a thorough review of the system and any logs available for the system to determine if a compromise took place. If a compromise took place take the appropriate steps to effectively contain, eradicate, and remediate the compromise.\\n7. Ensure appropriate security controls are in place such as firewalls, intrusion detection systems, and anti-virus software, to prevent future exposures.\"\n    },\n    {\n        \"issueTypeId\": \"MobileIronSentry\",\n        \"remediationGuidance\": \"If an attacker were to gain access to an exposed MobileIron Sentry instance, they could potentially steal sensitive corporate data, such as emails, documents, and passwords.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the exposed instance from the network to prevent further damage.\\n2. Assess the extent of the exposure and determine what data has been compromised.\\n3. Identify the root cause of the exposure, such as a misconfiguration or a vulnerability.\\n4. Apply patches or updates to fix the vulnerability or misconfiguration.\\n5. Change all passwords and access keys associated with the exposed instance.\\n6. Conduct a thorough security audit to identify any other potential vulnerabilities or exposures.\\n7. Implement additional security measures such as multi-factor authentication, network segmentation, and access controls to prevent future exposures.\"\n    },\n    {\n        \"issueTypeId\": \"MongoDBMongoExpress\",\n        \"remediationGuidance\": \"It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\\n\\nXpanse recommends securing your database software by taking the following steps:\\n\\n1. Isolate the database from the public internet by placing it behind a VPN.\\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"MongoServer\",\n        \"remediationGuidance\": \"MongoDB servers and database servers in general should not be publicly accessible over the internet as they almost always contain sensitive data and are not intended to be deployed in this way.\\n\\n1. Identify the exposed MongoDB server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Ensure that MongoDB is configured to use separate security credentials for each user and each process.  It is recommended to enable Role Based Access Controls (RBAC) for all MongoDB instances.\\n3. Leverage encryption either with TLS for data in transport or enable encryption at rest where the data is stored.\\n4. Enable auditing and logging allowing for audit trails for future investigation.\\n5. MongoDB server security best practices can be followed https://www.mongodb.com/docs/manual/administration/security-checklist/.\"\n    },\n    {\n        \"issueTypeId\": \"MOVEitTransfer\",\n        \"remediationGuidance\": \"If an attacker gains access to a MOVEit Transfer server, they could potentially perform unauthorized actions, such as intercepting, modifying, or stealing sensitive data being transferred. They may also manipulate the system configuration, compromise user accounts, or disrupt the file transfer process.\\n\\nOn July 6th, 2023, Progress Software released a limited service pack that contains fixes for three newly disclosed vulnerabilities. CVE-2023-36934 and CVE-2023-36932 are SQL injection vulnerabilities that could lead to malicious actors gaining unauthorized access to the MoveIT Transfer database. These two vulnerabilities are considered critical because they can be exploited without authentication. CVE-2023-36933 is a vulnerability that could allow an attacker to cause significant service interruptions in MoveIT Transfer by invoking commands that would trigger unhandled exceptions. Xpanse recommends applying the newly published https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 that addresses these vulnerabilities.\\n\\nOther versions of MOVEit Transfer are also vulnerable to a critical SQL injection vulnerability (CVE-2023-34362) that can allow an attacker to gain  unauthenticated access to the product&#39;s backend SQL database. It is recommended to review the security advisory posted by the vendor in order to determine if the server is vulnerable and how to remediate it. That advisory can be found https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.\\n\\nOther steps that can be taken to secure your MOVEit Transfer server are:\\n1. Isolate the exposed MOVEit Transfer server from the rest of the network to minimize potential attack surfaces and limit the attacker&#39;s lateral movement.\\n2. Ensure that the MOVEit Transfer server is running the latest software version and has all necessary security patches applied to address known vulnerabilities.\\n3. Implement multi-factor authentication (MFA) for all user accounts accessing the server, and regularly review and update access privileges based on the principle of least privilege.\\n4. Verify that all data transfers are encrypted both in transit and at rest, using strong encryption protocols like TLS and AES, to protect sensitive data from unauthorized access.\\n5. Regularly monitor the server for any signs of intrusion or abnormal activity, using tools like intrusion detection systems (IDS) and security information and event management (SIEM) solutions, and have incident response plans in place to handle potential security breaches.\\n\\nFor more information on configuration of the product, please reference the documentation found https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2023/page/Start-Transferring-Files-and-Data.html.\"\n    },\n    {\n        \"issueTypeId\": \"Moxa\",\n        \"remediationGuidance\": \"If an attacker gains access to a Moxa device, they could potentially compromise the security and integrity of the SCADA system and the connected industrial processes.\\n\\nIt is recommended to perform the following:\\n1. Identify the exposed Moxa device\\n2. Secure the device by changing the default password, disabling unnecessary services or features, and updating the firmware\\n3. Review the device configuration and implement security best practices\\n4. Implement network segmentation to isolate the Moxa device\\n5. Monitor the device for any suspicious activity or attempted attacks\\n\\nAfter identifying the specific Moxa device, it is also recommended to consult the documentation for the product which can be found https://www.moxa.com/en/support/product-support/software-and-documentation.\"\n    },\n    {\n        \"issueTypeId\": \"MoxaMXview\",\n        \"remediationGuidance\": \"Moxa MXview network management software is vulnerable to multiple critical CVEs such as CVE-2021-38452 (a path traversal vulnerability) and CVE-2021-38456 (a hardcoded password vulnerability).\\nEnsure that the latest security patches for MXview are installed.\\nVendor security advisories for MXview can be found https://www.moxa.com/en/support/product-support/security-advisory/security-advisories-all?psid&#61;53389.\"\n    },\n    {\n        \"issueTypeId\": \"MssqlServer\",\n        \"remediationGuidance\": \"Publicly exposing your organization\u2019s MSSQL servers increases the risk of being targeted by brute-force attacks. One recent example is the Vollgar campaign, a highly coordinated set of attacks believed to be originating from China that targeted publicly accessible MSSQL servers over the span of two years. It is recommended to restrict access to your MSSQL servers by taking the following steps:\\n\\n**1. Put your organization\u2019s MSSQL server behind a firewall** and configure it to accept connections only on certain ports. Connections should be blocked on default database ports, like 1433, because those are usually the first line of attack.\\n**2. Block all unexpected outbound network traffic** to prevent malware from phoning home; confidential data.\\n**3. Disable SQL Server Browser service** to reduce your organization\u2019s attack surface. The browser service uses UDP port 1434 and allows users to browse a list of current servers and connect to them and to administrator connection endpoints. By default, the browser service will expose the TCP port needed to connect to the MSSQL server, which is why it is recommended to specify the TCP port in the server\u2019s connection strings.\\n\\nFurther documentation:\\n * https://docs.microsoft.com/en-us/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access?view&#61;sql-server-ver16\\n * https://docs.microsoft.com/en-us/sql/tools/configuration-manager/sql-server-browser-service?view&#61;sql-server-ver16\"\n    },\n    {\n        \"issueTypeId\": \"MulticastDnsServer\",\n        \"remediationGuidance\": \"An exposed multicast DNS (mDNS) server could allow an attacker to query information about your network. Therefore, mDNS servers should not be accessible on the public internet.  If public exposure is necessary, consider whitelisting trusted devices and logging inbound traffic on port 5353.\"\n    },\n    {\n        \"issueTypeId\": \"MysqlServer\",\n        \"remediationGuidance\": \"It is recommended that database servers are not made accessible to the public internet. In order to securely utilize a MySQL server:\\n\\n1. Do not transmit unencrypted data to and from the MySQL server. Instead, use an encrypted protocol such as SSL or SSH.\\n2. Use a firewall to block all ingress and egress traffic from untrusted sources. If a web and database server are hosted on the same site, only expose the web server to the public internet. You can have traffic to and from the database server managed on a private LAN.\\n3. Require all MySQL accounts to have an associated password. Ensure these passwords are complex enough to withstand attacks. Consider using MFA for additional security.\\n4. Ensure you are running the latest version of MySQL server.\\n\\nFor additional security recommendations, visit https://dev.mysql.com/doc/refman/8.0/en/security.html\"\n    },\n    {\n        \"issueTypeId\": \"NetBiosNameServer\",\n        \"remediationGuidance\": \"NetBIOS is generally designed to be accessed by trusted clients inside trusted environments, therefore exposing NetBIOS directly to the Internet is not recommended.\\n\\n1. Best practice is to not have NetBIOS exposed to the Internet.\\n2. Use a firewall to filter inbound connections to NetBIOS and only allow trusted IPs and hosts.\\n3. Evaluate all devices utilizing NetBIOS and take a risk-based approach around the need for NetBIOS\"\n    },\n    {\n        \"issueTypeId\": \"NetGearDGNSeriesRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"NetGearProSafe\",\n        \"remediationGuidance\": \"NETGEAR ProSafe JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level (CVE-2020-26919\u200b). Further assessment is needed by organizations to infer vulnerability since this policy does not detect all of the necessary information to infer vulnerability.\"\n    },\n    {\n        \"issueTypeId\": \"NetGearWNRSeriesRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"NetisRouter\",\n        \"remediationGuidance\": \"Routers and networking infrastructure are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"Netty\",\n        \"remediationGuidance\": \"Netty is vulnerable to CVE-2022-41881, a stack overflow vulnerability. Netty applications are expected to be public facing, however steps should be taken to ensure a secure version of Netty is used. This can be done by:\\n\\n1. Upgrading Netty to the latest secure version. Upgrade to version 4.1.86 or later to protect against CVE-2022-41881.\\n2. Determine if this application needs to be removed from the public internet. If there is a business need to keep the application public, consider using a firewall or network access control list to restrict access to approved devices.\"\n    },\n    {\n        \"issueTypeId\": \"NetworkingAndSecurityInfrastructure\",\n        \"remediationGuidance\": \"Although this policy does not solely identify administration panels, in general, networking infrastructure should not have its administration panels open to the public internet. Compromise of these devices, often through password guessing or vulnerability exploitation, may provide privileged access to an enterprise network.\\n\\nRouters and firewalls are expected to be internet facing. Ensure that they are actively monitored and receiving the latest security updates.\"\n    },\n    {\n        \"issueTypeId\": \"NfsRpcBindServer\",\n        \"remediationGuidance\": \"Compromise of the rpcbind service could allow an adversary to query active services, and trigger unfreed memory allocations on the system leading to a remote Denial of Service. As a result, rpcbind should not be exposed to the public Internet.\\nIt is recommended to identify the asset owner and working with them to remove the device from the internet as it should not be publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"NoviSurvey\",\n        \"remediationGuidance\": \"NoviSurvey is vulnerable to numerous CVEs, such as CVE-2023-29492, a critical remote code execution vulnerability. To ensure best security practices are being followed:\\n\\n1. Assess whether this instance of NoviSurvey should be publicly available. If the server should not be accessible to the public, place the server on an internal network or limit access to approved devices.\\n2. Determine the current version of NoviSurvey. Upgrade to the latest secure version if necessary.\\n3. Stay up-to-date with the latest releases and security advisories https://novisurvey.net/blog/blog-survey-software-news.aspx.\"\n    },\n    {\n        \"issueTypeId\": \"OctoberCMS\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed October CMS server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization\u2019s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the October CMS server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\\n2. Regularly update the October CMS software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\\n5. Monitor the October CMS server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices.\"\n    },\n    {\n        \"issueTypeId\": \"OgwNonCompliantLongExpirationCertificate\",\n        \"remediationGuidance\": \"1. Best practice is to establish a formal SSL/TLS server certificate management program that tracks all certificates including the expiration date in a central location. \\n2. Identify all existing certificates and their expiration dates. For certificates with a validity period greater than 397 days follow established procedure to revoke and replace the certificate.\\n3. NIST has released Special Publication 1880-16A that provides in-depth guidance on securing web transactions. https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html\"\n    },\n    {\n        \"issueTypeId\": \"OgwNonCompliantSelfSignedServerCertificate\",\n        \"remediationGuidance\": \"1. Devices directly accessible from the internet should not be utilizing self-signed certificates. Since these certificates lack signing by a certificate authority (CA) they cannot be revoked or verified easily.\\n2. Identify the device with the self-signed certificate and identify if it should be accessible to the internet.\\n3. To replace a self-signed certificate with one from a certificate authority it is best practice to follow guidelines from the manufacturer, vendor, or internal documentation as this process can vary widely.\"\n    },\n    {\n        \"issueTypeId\": \"OGWNonCompliantWebServer\",\n        \"remediationGuidance\": \"When STS is not configured, threat actors can run SSL stripping attacks, making all web connections unencrypted. It is recommended to enable HTTP Strict Transport Security (HSTS) by following these steps:\\n\\n1. Add a Strict-Transport-Security response header to your application with the value: max-age&#61;31536000. This will inform the browser that it should not allow that web application to be accessed over HTTP during the configured time. The max age should be set to at least one year.\\n2. Add the includeSubDomains flag, which will enforce HSTS at the subdomain level.\\n3. Consider submitting your application\u2019s domain to preload lists. Preloading is not a hard requirement in OGW directives, but preloading will prevent SSL stripping attacks on first use. Preloading may not be a feasible solution if any subdomains are expected to function over HTTP, as it will make those subdomains inaccessible.\\n\\nFurther documentation: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html.\"\n    },\n    {\n        \"issueTypeId\": \"OGWNonCompliantWebServerDisallowedAlgorithms\",\n        \"remediationGuidance\": \"The weak or disallowed algorithms flagged by this policy are easily exploitable, and supporting them could lead to sensitive data leaks. These cipher suites should be disabled in favor of cryptographic algorithms that are considered secure, like SHA256, SHA384, SHA512, and ECDSA.\"\n    },\n    {\n        \"issueTypeId\": \"OGWNonCompliantWebServerExpiredCertificate\",\n        \"remediationGuidance\": \"Applications with expired certificates are vulnerable to multiple attack vectors, the most serious being phishing and man-in-the-middle (MITM) attacks. Allowing an application to operate with expired certificates could cause significant reputational impact due to certificate outages and, in the worst scenario, could lead to a data breach.\\n\\nImplementing a centralized certificate management system to track all certificates in your organization is considered a best practice. Once visibility is gained into your organization\u2019s certificate landscape, expiring or expired certificates must be re-issued.\\n\\nNIST\u2019s guidance on https://www.nccoe.nist.gov/publication/1800-16/VolA/index.html contains more information on establishing an effective certificate program and best practices for refreshing certificates.\"\n    },\n    {\n        \"issueTypeId\": \"OGWNonCompliantWebServerInsecureCertificate\",\n        \"remediationGuidance\": \"MD5 and SHA-1 cryptographic hashing functions can be used to stage cryptographic collision attacks, which may enable malicious actors to compromise in a stealth manner communications that seem secure on the surface.\\n\\nThese types of attacks are notoriously challenging to detect, so it is recommended that all certificates using MD-5 and SHA-1 are replaced with certificates using more cryptographically robust hashes, like SHA-2 and SHA-3.\\n\\nCertificates with public key sizes less than 2048 bits are vulnerable to brute force attacks and considered cryptographically unhealthy. NIST recommends that public certificates have key sizes of 2048 or above.\\n\\nMore information on the attack vectors associated with MD-5 and SHA-1 can be found in https://www.rfc-editor.org/rfc/rfc4270, published by IETF.\\n\\nNIST\u2019s https://csrc.nist.gov/projects/key-management/key-management-guidelines provides more information regarding current key management standards.\"\n    },\n    {\n        \"issueTypeId\": \"OGWNonCompliantWebServerInsecureTLS\",\n        \"remediationGuidance\": \"The SSL/TLS versions flagged by this policy are famously insecure and increasingly less supported by modern browsers. The exploitation of these protocols could lead to attacks such as Padding Oracle On Downgraded Legacy Encryption (POODLE), Browser Exploit Against SSL/TLS (BEAST), and Compression Ratio Info-leak Made Easy (CRIME), which could lead to critical data leaks.\\n\\nComplying with OGW directives requires disabling TLS 1.0, TLS 1.1, SSL 2.0, and SSL 3.0.\"\n    },\n    {\n        \"issueTypeId\": \"OPCUA\",\n        \"remediationGuidance\": \"If an attacker were to gain access to an OPC UA Discovery Server, they could potentially discover all the OPC UA enabled devices and applications in the network. This information could be used to launch targeted attacks against these devices or applications, potentially leading to unauthorized access, data theft, or even physical damage to industrial processes.\\n\\nIt is recommended to perform the following:\\n1. Identify and document all devices and applications that are exposed by the Discovery Server.\\n2. Verify that the Discovery Server is properly configured and secured, and that it&#39;s only accessible to authorized personnel.\\n3. Patch any known vulnerabilities on the Discovery Server and all exposed devices and applications.\\n4. Implement strong access controls, including multi-factor authentication and role-based access control, to restrict access to the Discovery Server and all exposed devices and applications.\\n5. Monitor the Discovery Server and all exposed devices and applications for any suspicious activity, using intrusion detection systems and security information and event management (SIEM) tools.\\n\\nDocumentation on OPC UA can be found on the OPC Foundation&#39;s site https://reference.opcfoundation.org/\"\n    },\n    {\n        \"issueTypeId\": \"OpenBgpServer\",\n        \"remediationGuidance\": \"BGP servers are naturally exposed to the internet as they allow for routing between networks. BGP servers, if not properly secured, can result in malicious rerouting of internet traffic and eavesdropping.\\n\\n1. Identify the exposed BGP server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Identify the manufacturer of the BGP appliance and ensure it is fully patched.\\n3. BGP server security best practices from the NSA can be followed https://www.nsa.gov/portals/75/documents/what-we-do/cybersecurity/professional-resources/ctr-guide-to-border-gateway-protocol-best-practices.pdf.\\n4. NIST has also released special guidance on securing the internet including DDoS protection for BGP https://csrc.nist.gov/publications/detail/sp/800-189/final.\"\n    },\n    {\n        \"issueTypeId\": \"OpenLiteSpeedWebServer\",\n        \"remediationGuidance\": \"Although OpenLiteSpeed comes with solid out-of-the-box security features, it can still be susceptible to various attacks, like remote-code execution, privilege escalation, directory traversal, cross-site scripting (XSS), and MIME sniffing.\\n\\nOrganizations can use the information surfaced by this policy to audit their attack surface and take the following steps:\\n\\n1. Validate the current running versions of OpenLiteSpeed in your organizations and upgrade if any of them are impacted by confirmed vulnerabilities.\\n2. Review the current OpenLiteSpeed configuration(s) against the https://openlitespeed.org/kb/ols-configuration-examples/ to prevent misconfigurations that could lead to leaking sensitive data.\\n3. Consider using LiteSpeed\u2019s built-in WAF features to detect and filter malicious traffic.\\n4. Ensure DoS and DDoS protection is running smoothly by reviewing the IP-level connection accounting and limit settings.\"\n    },\n    {\n        \"issueTypeId\": \"OpenSSL\",\n        \"remediationGuidance\": \"OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. Outdated versions of OpenSSL are exploitable to multiple known vulnerabilities including CVE-2022-0778 that allows for Denial-of-Service (DoS).\\n1. Backported versions require system access and cannot be done accurately from the internet, it is recommended to verify vulnerabilities on the system through a change log or other means.\\n2. Outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to a supported version of OpenSSL and apply latest security updates. Latest versions can be found at https://www.openssl.org/source/\\n3. Mitigation and update guidance can also be found https://www.openssl.org/docs/man3.0/man7/migration_guide.html\"\n    },\n    {\n        \"issueTypeId\": \"OpenVPNAdminPortal\",\n        \"remediationGuidance\": \"While OpenVPN servers are expected to be found on the public internet, a publicly accessible admin portal will likely be targeted by attackers. To improve your security posture consider the following options:\\n\\n* Disable the admin UI port in the network setting page. By default, this will restrict access of the admin portal to TCP port 943.\\n* Consider serving the admin portal on a different port. Then, use a firewall to limit access to the port to approved devices.\\n* Utilize defense mechanisms to mitigate against brute-force and dictionary attacks. Common strategies include enforcing strong passwords, utilizing lockouts, and sending notifications on successive failed attempts.\"\n    },\n    {\n        \"issueTypeId\": \"OracleAccessManagement\",\n        \"remediationGuidance\": \"Oracle Access Management has frequently been susceptible to vulnerabilities that allow unauthenticated attackers to access and manipulate critical data, https://nvd.nist.gov/vuln/detail/CVE-2022-39412 and https://nvd.nist.gov/vuln/detail/CVE-2022-39405 being the most recent examples.\\n\\nXpanse recommends staying apprised of https://www.oracle.com/security-alerts/ for OAM and applying critical patches as soon as possible if your version of OAM is affected. Organizations are also strongly encouraged to review in-depth Oracle\u2019s recommended security best practices for OAM, guidelines which can be found https://docs.oracle.com/en/middleware/idm/access-manager/12.2.1.3/aiaag/.\"\n    },\n    {\n        \"issueTypeId\": \"OracleEBusinessSuite\",\n        \"remediationGuidance\": \"If an attacker gains access to an Oracle E-Business Suite server, they can potentially steal sensitive data such as customer information, financial records, or intellectual property. They can modify, delete, or corrupt data, which can disrupt business operations and cause significant financial and reputational damage.\\n\\nIt is recommended to perform the following in order to remain secure:\\n\\n1. Update your system: Look for any available updates from Oracle and apply them to your system. This will make sure any known issues are fixed and your system is up-to-date.\\n\\n2. Turn off unnecessary services: Check your installed services and turn off any that you don&#39;t need. This will reduce your system&#39;s exposure to attacks and limit the number of potential problems.\\n\\n3. Make your system secure: Make sure your system is configured properly and securely. This includes changing default passwords, disabling unnecessary accounts, and making sure passwords are strong.\\n\\n4. Check for problems often: Regularly scan your system for vulnerabilities so you can find any problems before they are exploited.\\n\\n5. Control who has access: Limit access to sensitive data and functions to prevent unauthorized access and limit the damage of any security breaches.\\n\\nOracle&#39;s documentation for E-Business Suite can be found https://docs.oracle.com/cd/E51111_01/current/html/docset.html.\"\n    },\n    {\n        \"issueTypeId\": \"OracleOPERA\",\n        \"remediationGuidance\": \"If an instance of Oracle OPERA is found to be exposed and vulnerable, it is important to take immediate action to remediate the issue. Here are some steps that can be taken:\\n\\n1. Isolate the vulnerable system from the rest of the network to prevent further potential attacks or lateral movement.\\n2. Identify any specific vulnerabilities and apply any available patches provided by Oracle. This may involve updating the software to a more recent version.\\n3. Review the security controls in place and update them if necessary. This may include implementing additional access controls, updating firewall rules, and reviewing user permissions.\\n4. Conduct a security assessment to determine if compromise of the system took place.\\n5. Monitor the system for any signs of suspicious activity or attempts to exploit the vulnerability.\"\n    },\n    {\n        \"issueTypeId\": \"OracleSolaris\",\n        \"remediationGuidance\": \"Per CISA&#39;s https://www.cisa.gov/news-events/alerts/2023/07/18/oracle-releases-security-updates, Xpanse recommends staying up-to-date on applying patches to Oracle Solaris.\"\n    },\n    {\n        \"issueTypeId\": \"OracleWebLogicServer\",\n        \"remediationGuidance\": \"Multiple classes of vulnerabilities affect Oracle Web Logic Servers (such as Remote Code Execution or Denial of Service).\\nIt is recommended to identify the asset owner and verify that the Oracle Web Logic Server needs to be exposed to the internet. If not, work with them to remove it.\\nIf the Oracle Web Logic Server needs to be exposed to the internet, it is recommended to take a look at Oracle&#39;s documentation on security hardening found https://docs.oracle.com/cd/F30719_01/DESG/Content/hardening.htm\\nIt is also recommended to place the server behind security controls such as a Web Application Firewall (WAF).\"\n    },\n    {\n        \"issueTypeId\": \"OutdatedNginxWebServer\",\n        \"remediationGuidance\": \"Identify the asset owner and work with them to update the server to a stable and secure version.\\nUpgrade instructions can be found here: https://nginx.org/en/docs/install.html\\nNote: Be sure to back up your NGINX configuration before proceeding with the update.\"\n    },\n    {\n        \"issueTypeId\": \"PaloAltoNetworksFirewallAdminLoginPage\",\n        \"remediationGuidance\": \"Identify the owner of the affected asset and work with them to perform the following:\\nRemove the admin login page from the internet. For more details on how this may be accomplished (as well as other best practices for hardening your firewall&#39;s admin access), please reference the following document:\\nhttps://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/getting-started/best-practices-for-securing-administrative-access\\n\\nNote the version in the document shown on the page and ensure it matches the version your firewall is running.\"\n    },\n    {\n        \"issueTypeId\": \"PaloAltoNetworksGlobalProtect\",\n        \"remediationGuidance\": \"VPN devices are often publicly accessible and, as a result, are a frequent target of sophisticated attacks. GlobalProtect is vulnerable to several high-impact vulnerabilities (for example, https://nvd.nist.gov/vuln/detail/CVE-2022-0017 and https://nvd.nist.gov/vuln/detail/CVE-2022-0017) that could lead to unauthenticated attackers performing vertical privilege escalation or remote code execution. To secure your instances of Global Protect, Xpanse recommends implementing a Zero-Trust architecture and staying up-to-date on the latest patches:\\n\\n1. Create a security zone for all VPN traffic using the GlobalProtect configuration options. Using security zones is a security best practice for VPNs because it creates a tunnel interface and gives organizations visibility into the IP pools used for remote users. This zero-trust approach helps with proactively detecting intruders and containing attacks for remote users. Please note that split tunneling is not recommended as it may lead to critical data being intercepted by malicious actors.\\n2. Create NAT policies to secure traffic from the VPN security zone and use user groups and application IDs to reduce your organization\u2019s attack surface.\\n3. Closely monitor traffic logs by looking at the egress traffic captured in ACC (App Command Center)\\n4. Ensure that disabling GlobalProtect is only allowed for a short interval of time (the default timeout is 30 min)\\n5. Enable 2FA for all users\\n6. Enable HIP (Host Information Profile) data collection to collect host-based data and apply that to your firewall (which helps with policy enforcement). You can also implement custom checks to verify specific security requirements (e.g., OS patch level) before allowing connections to critical resources.\\n\\nMore information can be found in the https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect.\"\n    },\n    {\n        \"issueTypeId\": \"PanOsDevice\",\n        \"remediationGuidance\": \"Management interfaces should not be accessible on the public internet. They are frequently targeted in attacks, and could allow an attacker to gain access to a network. If the management interface must be accessible outside of the intranet, consider using an access control list or utilizing a VPN.\"\n    },\n    {\n        \"issueTypeId\": \"PaperCutMF\",\n        \"remediationGuidance\": \"If an attacker gains access to PaperCut MF, they may exploit printing, copying, scanning, and faxing resources, access sensitive information in documents, modify usage quotas and restrictions, and disrupt the operation of multi-function devices.\\n\\nPaperCut MF is affected by CVE-2023-27350 which allows attackers to execute malicious code remotely and without authentication.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Verify the version of PaperCut MF that the service is running.\\n2. If the version being ran is vulnerable to CVE-2023-27350, it is recommended to upgrade to the latest secure version. More information regarding patches and remediation can be found on the advisory posted by PaperCut https://www.papercut.com/kb/Main/PO-1216-and-PO-1219.\\n\\nOther important security steps to follow are:\\n1. Restrict access to authorized users and devices using firewalls and access control lists.\\n2. Implement strong authentication methods, such as two-factor authentication.\\n3. Encrypt communication between clients and PaperCut MF using SSL/TLS.\\n4. Regularly review user access, configurations, and security settings for compliance.\\n5. Continuously monitor and log PaperCut MF-related activities to detect and respond to threats.\"\n    },\n    {\n        \"issueTypeId\": \"PaperCutMobility\",\n        \"remediationGuidance\": \"If an attacker gains access to a PaperCut Mobility server, they may exploit print resources, intercept sensitive information in documents being printed, and disrupt mobile printing operations.\\n\\nPaperCut MF and PaperCut NG are affected by CVE-2023-27350 which allows attackers to execute malicious code remotely and without authentication.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Verify the version of PaperCut that the service is running.\\n2. If the version being ran is vulnerable to CVE-2023-27350, it is recommended to upgrade to the latest secure version. More information regarding patches and remediation can be found on the advisory posted by PaperCut https://www.papercut.com/kb/Main/PO-1216-and-PO-1219.\\n\\nOther important security steps to follow are:\\n1. Restrict access to authorized users and devices using firewalls and access control lists.\\n2. Implement strong authentication methods, such as two-factor authentication, for mobile devices.\\n3. Encrypt communication between mobile devices and the PaperCut Mobility server using SSL/TLS.\\n4. Regularly review user access, configurations, and security settings for compliance.\\n5. Continuously monitor and log PaperCut Mobility-related activities to detect and respond to threats.\"\n    },\n    {\n        \"issueTypeId\": \"PaperCutNG\",\n        \"remediationGuidance\": \"If an attacker gains access to PaperCut NG, they can potentially misuse printing resources, access sensitive information in printed documents, alter print quotas and restrictions, and disrupt printing services.\\n\\nPaperCut NG is affected by CVE-2023-27350 which allows attackers to execute malicious code remotely and without authentication.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Verify the version of PaperCut NG that the service is running.\\n2. If the version being ran is vulnerable to CVE-2023-27350, it is recommended to upgrade to the latest secure version. More information regarding patches and remediation can be found on the advisory posted by PaperCut https://www.papercut.com/kb/Main/PO-1216-and-PO-1219.\\n\\nOther important security steps to follow are:\\n1. Limit access to the PaperCut NG service to authorized users and devices using firewalls and access control lists.\\n2. Implement strong authentication methods, such as two-factor authentication, for accessing the service.\\n3. Use encryption (e.g., SSL/TLS) to protect communication between clients and the PaperCut NG service.\\n4. Periodically review user access, configurations, and security settings to ensure compliance with best practices.\\n5. Continuously monitor and log activities related to PaperCut NG to detect and respond to potential security threats.\"\n    },\n    {\n        \"issueTypeId\": \"PhpMyAdmin\",\n        \"remediationGuidance\": \"It is considered a best practice for databases not to be publicly accessible over the internet as it puts organizations at risk for data leaks or manipulation by malicious actors.\\n\\nXpanse recommends securing your database software by taking the following steps:\\n\\n1. Isolate the database from the public internet by placing it behind a VPN.\\n2. If there is a strong business case for public accessibility, all database instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that database instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on database instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"PiHole\",\n        \"remediationGuidance\": \"Pi-Hole acts as a DNS sinkhole and optionally a DHCP server, and is intended for use only on private networks. This issue identifies all Pi-Hole servers regardless of version. Per CVE-2020-8816, the Pi-Hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.\"\n    },\n    {\n        \"issueTypeId\": \"PlexMediaServer\",\n        \"remediationGuidance\": \"To secure Plex Media Server instances, it is recommended to perform the following:\\n\\n1. Isolate Plex Media Server instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Plex Media Server instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Plex Media Server instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Plex Media Server instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"Pop3Server\",\n        \"remediationGuidance\": \"Some of the most glaring issues with POP3 are its lack of encryption, lack of compatibility with modern authentication systems like MFA and the high risk of critical data loss in case the destination device is compromised or destroyed.\\n\\nXpanse recommends taking the following steps to secure POP3 instances:\\n\\n1. Evaluate whether using a limited, insecure protocol like POP3 is absolutely necessary in your organization, or whether IMAP with TLS would be a better alternative.\\n2. Should it be necessary to use POP3, it is recommended to enable it to run with implicit TLS encryption over port 995. Another option is using POP3 with explicit TLS over port 110, which allows for traffic to be encrypted if both client and server support STARTTLS.\\n3. Place POP3 instances behind a firewall to monitor and control e-mail server traffic.\\n4. Do not use third-party e-mail clients that don\u2019t support MFA, as MFA can be easily bypassed when attempting authentication.\"\n    },\n    {\n        \"issueTypeId\": \"PostgreSQLpgAdminLoginPortal\",\n        \"remediationGuidance\": \"Since web-based admin portals are often misconfigured and vulnerable to exploits that are trivial to run, it is essential to not publicly expose your organization\u2019s PostgreSQL servers to the internet. Secure your PostgreSQL servers by taking the following steps:\\n\\n1. Put pgAdmin instances behind a firewall and configure it to accept connections only on a small subset of ports.\\n2. Prevent brute force password attacks by ensuring the *MAX_LOGIN_ATTEMPTS* verification check is enabled and set to 3 or another low number. You can configure this check in the User Management dialog in the pgAdmin interface or the main configuration file *config.py*. This feature is disabled if the value is set to 0.\\n3. Since PostgreSQL does not have strong password complexity checks available, the use of external authentication services is recommended. pgAdmin supports both LDAP and Kerberos and can be integrated with SSO.\\n4. Upgrade to the latest version of pgAdmin and install critical security patches. It is particularly important to update pgAdmin to version 6.7&#43; to prevent directory traversal attacks.\\n\\nFurther documentation:  https://www.pgadmin.org/docs/pgadmin4/6.10/index.html\"\n    },\n    {\n        \"issueTypeId\": \"PostgreSQLpgwebLoginPortal\",\n        \"remediationGuidance\": \"It is recommended that database login portals are not made accessible to the public internet. In order to securely deploy pgAdmin:\\n\\n1. Do not transmit unencrypted data to and from the pgAdmin portal. Instead, use an encrypted protocol such as SSL or SSH.\\n2. Use a firewall to block all ingress and egress traffic from untrusted sources. If a web and database server are hosted on the same site, only expose the web server to the public internet. You can have traffic to and from the database server managed on a private LAN.\\n3. Require all database accounts to have an associated password. Ensure these passwords are complex enough to withstand common dictionary attacks.\\n4. Consider using MFA for additional security.\\n5. Ensure you are running the latest version of pgAdmin server.\"\n    },\n    {\n        \"issueTypeId\": \"PostgresServer\",\n        \"remediationGuidance\": \"1. Best practice is to not expose Postgres servers to the internet.\\n2. Evaluate if this Postgres Server needs to be exposed to the public internet for business purposes.\\n3. If the server does need to be exposed to the public internet or an internal network, it is recommended that the system is configured to listen for and accept connections on the networks that are actually required. Leveraging a layered security approach, including firewalls, encryption, roles, ACLs, and strong authentication practices will help. \\n4. If the server does not need to be exposed to the internet, the follow security guidelines set forth by Postgres https://www.postgresql.org/docs/current/runtime.html\"\n    },\n    {\n        \"issueTypeId\": \"PptpServer\",\n        \"remediationGuidance\": \"Point-to-Point Tunneling Protocol (PPTP) includes extremely weak authentication and does not establish the integrity of data transported through the PPTP VPN. To minimize the risk of such vulnerabilities, verify the following:\\n\\n1. Best practice is to replace PPTP servers with modern VPN servers immediately.\\n2. If use of PPTP is a business requirement, set Data Encryption to \u201cMaximum strength encryption\u201d and authentication to EAP-TLS or other alternatives to MSChap versions.\"\n    },\n    {\n        \"issueTypeId\": \"PrimeTekPrimeFaces\",\n        \"remediationGuidance\": \"There are multiple CVEs associated with PrimeTek PrimeFaces, such as CVE-2017-1000486 (a weak encryption flaw leading to remote code execution) and CVE-2020-10544 (a cross-site scripting vulnerability).\\nTo secure the server, ensure you are using the latest version of PrimeTek PrimeFaces.\"\n    },\n    {\n        \"issueTypeId\": \"PrometheusMonitoringFramework\",\n        \"remediationGuidance\": \"If you have identified a vulnerable and exposed instance of Prometheus Monitoring Service, it is important to take immediate action to remediate the vulnerability and protect your system from potential attacks. Here are some steps you can take:\\n\\n1. Quarantine the machine hosting the Prometheus Monitoring Service to prevent further potential compromise.\\n2. Review all available network and host based logs to determine if a compromise took place. If it is determined a compromise took place take all appropriate steps to contain, eradicate, and remediate the incident.\\n3. Check if there is a new version of Prometheus Monitoring Service available, and upgrade to the latest version if possible. This may include updating dependencies and plugins as well.\\n4. Review security controls and ensure that only the necessary ports are open. Restrict access to the Prometheus Monitoring Service from only trusted sources.\\n5. Ensure that the system hosting the Prometheus Monitoring Service is hardened and configured securely. This includes configuring secure passwords, limiting user access, and disabling unnecessary services.\\n6. Implement monitoring and alerts to detect any future vulnerabilities or attacks. This may include setting up alerts for unusual activity, configuration changes, or failed login attempts.\\n7. Conduct a vulnerability scan of the system to identify any other vulnerabilities that may exist.\"\n    },\n    {\n        \"issueTypeId\": \"PulseSecurePulseConnectSecureVPN\",\n        \"remediationGuidance\": \"Unpatched and misconfigured Pulse Secure VPN Servers pose a serious security risk to any organization as severe vulnerabilities have been released including remote code execution (RCE) with a total of over 70 CVEs published for this device.\\n\\n1. Pulse Connect Secure VPN Servers should be patched as soon as possible to prevent active exploits from being successfully ran against these devices.\\n2. VPN servers should be configured to include verbose logging to identify activities such as compromised account logins, anomalous geolocation based logins, brute force activity, injection attacks, impossible logins, single IPs hitting multiple accounts, and more.\\n3. Ensure administration/backend portals for Pulse Connect Secure VPN are not publicly available.\\n4. Ensure your IR plan for reacting to incidents involving your Pulse Connect Secure VPN include the ability to terminate sessions for users and deploy countermeasures in a swift timely manner.\\n5. Based on your organization and the nature of it&#39;s business consider geolocation IP filtering for access to the user login interface.\\n6. Consider blocking known TOR exit node traffic.\\n7. If possible obfuscate the nature of the server/domain hosting Pulse Connect Secure VPNs by sanitizing applicable DNS records, server responses, and the domain name.\\n8. Pulse Secure VPN Best Practices https://docs.pulsesecure.net/WebHelp/PDC/Migration%20Guides/NC_to_PDC/Content/Links_Network_Connect_to_Pulse_Desktop_Client_Migration_Guide/Considering_Best_Practices.htm\"\n    },\n    {\n        \"issueTypeId\": \"QNAPNAS\",\n        \"remediationGuidance\": \"To secure QNAP NAS instances, it is recommended to perform the following:\\n\\n1. Isolate QNAP NAS instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all QNAP NAS instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that QNAP NAS instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on QNAP NAS instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"QuestKaceSystemManagementAppliance\",\n        \"remediationGuidance\": \"If it is determined that this asset should not be publicly accessible from the internet, identify the asset owner and work with them to restrict access.\\nIf the asset needs to be exposed to the public internet for a business purpose, it is recommended to put the device behind a security tool such as a Web Application Firewall (WAF).\"\n    },\n    {\n        \"issueTypeId\": \"RabbitMQ\",\n        \"remediationGuidance\": \"Due to RabbitMQ acting as a single location for applications to communicate, it can potentially contain sensitive information.\\nIt is recommended to enable TLS support as well as working to implement various access control and authentication features in RabbitMQ.\\nMore information regarding configuration of Rabbit MQ can be found on the vendor site https://www.rabbitmq.com/admin-guide.html.\"\n    },\n    {\n        \"issueTypeId\": \"RdpServer\",\n        \"remediationGuidance\": \"Recommendations to reduce the likelihood of malicious RDP attempts are as follows:\\n\\n1. Best practice is to not have RDP publicly accessible on the Internet and instead only on trusted local networks.\\n2. Implement a risk-based approach that prioritizes patching RDP vulnerabilities that have known weaponized public exploits.\\n3. Limit RDP access to a specific user group and implementing lockout policies is an additional measure to protect against RDP brute-forcing which is another common tactic used by attackers. In addition, enable NLA (Network Level Authentication) which is non-default on older versions.\\n4. If remote access to RDP or terminal services is a business requirement, it should only be made accessible through a secure Virtual Private Network (VPN) connection with multi-factor authentication (MFA) to the corporate network or through a zero-trust remote access gateway.\"\n    },\n    {\n        \"issueTypeId\": \"RedisEnterpriseLoginPortal\",\n        \"remediationGuidance\": \"Redis is designed to be accessed by trusted clients inside trusted environments. Basic steps to harden Redis insances include:\\n\\n1. Redis Enterprise should be deployed on a trust network and not accessible to the public Internet.\\n2. Anti-virus exclusions should be implemented to ensure anti-virus and security solutions do not interfere with Redis Enterprise in order to maintain availability.\\n3. Send logs to a remote logging server.\\n4. Configure nodes to reboot in a sequence rather than all at once.\\n5. Implement client-side encryption if encryption in memory is required.\\n6. Implement role-based access for users.\\n7. Prevent database uses from logging into the admin console.\\n8. Disable the default user.\\n9. Enable client certificate authentication.\\n10. Leverage LDAP authentication if LDAP is used within the organization.\\n\\nAdditional recommendations:\\nhttps://docs.redis.com/latest/rs/security/\"\n    },\n    {\n        \"issueTypeId\": \"RedisServer\",\n        \"remediationGuidance\": \"Although Redis is not inherently vulnerable, its default configurations have weak authentication, encryption, or access control options and can open up your organization to breaches. For example, a common attack vector for Redis data stores is abusing these weak default configurations to perform unauthorized crypto mining on Redis instances.\\n\\nXpanse recommends taking swift action to harden your organization\u2019s Redis instances:\\n\\n1. Since Redis is by default bound to network interfaces and is often misconfigured or unsecured, it is recommended that Redis should only ever be available to trusted clients on your network. Therefore, a good first measure is to restrict access to the Redis port so that it is only accessible by the web application server.\\n2. Redis does not enforce authentication by default, so enabling authentication and enforcing robust password policies and ACLs is imperative.\\n3. Enable TLS so that all communications are encrypted\\n4. Rename critical commands, such as &#96;FLUSHDB&#96; and &#96;FLUSHALL&#96; , so that attackers cannot perform nuclear operations on the database if breached.\\n5. It is advisable to use the Redis Enterprise Cloud product instead of the open-source version, as the Cloud edition has more secure configuration options.\\n\\nPlease review the https://redis.io/docs/management/security/ for more information on securing Redis.\"\n    },\n    {\n        \"issueTypeId\": \"RejettoHttpFileServer\",\n        \"remediationGuidance\": \"To secure Rejetto instances, it is recommended to perform the following:\\n\\n1. Isolate Rejetto instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Rejetto instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Rejetto instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Rejetto instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"RockwellAutomationCompactLogix5370SeriesPLCController\",\n        \"remediationGuidance\": \"The exploitation of ICS devices like Rockwell Automation\u2019s CompactLogix 5370 Series PLC could lead to malicious actors interfering with critical infrastructure or high-stakes automation processes. Therefore, it is recommended that CompactLogix 5370 Series PLCs are not publicly exposed to the internet.\\n\\nThe following remediation guidance is recommended for securing Rockwell Automation CompactLogix 5370 Series PLC:\\n\\n1. Minimize network exposure by deploying the CompactLogix 5370 Series PLC behind a firewall and ensure it is not directly accessible from the Internet. Block unauthorized traffic and regularly monitor network traffic to detect any suspicious activity.\\n2. If remote access is required, limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system.\\n3. Implement strong authentication measures to prevent unauthorized access, such as multi-factor authentication and strong password policies.\\n4. Keep the PLC&#39;s hardware and software up to date by regularly applying patches and updates to address known vulnerabilities.\\n5. Reduce the attack surface of the system by disabling any unused services on the PLC.\\n6. For additional guidance, Xpanse recommends following https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"RockwellAutomationMicroLogix1400SeriesPLCController\",\n        \"remediationGuidance\": \"Given the importance of PLCs in managing and operating industrial control systems, these devices should not be accessible from the public Internet. If peered, local connections are insufficient, remote management should be strictly controlled to ensure only authenticated users can access these devices. Xpanse recommends securing PLCs by taking the following steps:\\n\\n1. Change the default credentials: Rockwell MicroLogix PLCs can be accessed remotely if the default HTTP credentials are not changed.\\n2. Place networked PLC systems behind a firewall and implement logical separation to isolate the device from other critical systems.\\n3. Expeditiously update PLC software and firmware to use the latest patches.\\n4. Implement strict access control policies that follow the principle of least privilege. This means that all users should have access only to the essential components that allow them to do their jobs.\\n5. Regularly monitor network activity and user engagement and set up robust alerting.\\n6. Review logs to determine if any compromise took place prior to the discovery of the exposed device.\"\n    },\n    {\n        \"issueTypeId\": \"RoundcubeWebmail\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Roundcube Webmail server, they could potentially compromise the entire email system, affecting multiple users and accounts. This could lead to unauthorized access to sensitive information, personal data, and contacts of all users on the server.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Regularly update the Roundcube Webmail software, plugins, and underlying server software to ensure that all known vulnerabilities are patched.\\n2. Implement strong authentication mechanisms such as multi-factor authentication (MFA) and enforce the use of strong, unique passwords for all user accounts.\\n3. Configure firewalls and access control lists (ACLs) to restrict incoming and outgoing traffic to the Roundcube Webmail server, allowing only necessary and trusted connections.\\n4. Enable encryption (e.g., SSL/TLS) for both data in transit and at rest to protect sensitive information from unauthorized access and tampering.\\n5. Perform regular security audits, vulnerability assessments, and monitor server logs to detect and respond to potential threats, unauthorized access, or suspicious activity in a timely manner.\"\n    },\n    {\n        \"issueTypeId\": \"RpcBindServer\",\n        \"remediationGuidance\": \"By default, rpcbind servers have weak authentication mechanisms and have the ability to assign a wide range of ports for the services it controls.\\n1. Use a blocklist to ensure only trusted sources can communicate with rpcbind servers.\\n2. Avoid using hostnames when specifying procedure destinations, as they can be spoofed using techniques such as DNS poisoning. Instead, only use IP addresses.\\n3. For additional security recommendations, visit https://www.rfc-editor.org/rfc/rfc5531.html#section-14.\"\n    },\n    {\n        \"issueTypeId\": \"RsyncServer\",\n        \"remediationGuidance\": \"Rsync servers should not be exposed to the internet as they may contain sensitive information especially since data exposure has become a prominent business risk to organizations.\\n\\n1. Identify the exposed Rsync server and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Rsync should be configured with hosts allow and hosts deny directives in order to follow least privilege principles.\\n3. Rysnc should then be setup to use the auth users directive which narrows the attack surface by user.\\n4. SSH should be leveraged for all Rysnc communication to allow for encryption.\"\n    },\n    {\n        \"issueTypeId\": \"RtspServer\",\n        \"remediationGuidance\": \"Real Time Streaming Protocol (RTSP) should never be exposed to the internet as most RTSP servers are embedded systems that contain numerous vulnerabilities, many of which cannot be patched.\\nIt is recommended to identify the device with the RTSP server and configure the device to not be directly accessible from the internet.\"\n    },\n    {\n        \"issueTypeId\": \"RubyOnRails\",\n        \"remediationGuidance\": \"The security requirements of a Ruby on Rails web applications will vary drastically depending on the implementation. General recommendations include determining if the instance should be publicly accessible, implementing a WAF, and running the latest secure version.\\n\\nFor Ruby on Rails specific security considerations, visit the https://guides.rubyonrails.org/security.html.\"\n    },\n    {\n        \"issueTypeId\": \"RuckusWirelessAdmin\",\n        \"remediationGuidance\": \"If you have an exposed instance of Ruckus Wireless Admin, it is important to take immediate action to remediate the situation to prevent unauthorized access and potential security breaches. Here are some steps you can take to remediate an exposed instance of Ruckus Wireless Admin:\\n\\n1. Determine how the instance was exposed in the first place. This could be due to a misconfigured firewall, an open port, or an unsecured wireless network.\\n2. Once you have identified the cause of the exposure, take steps to secure the instance. This may include updating firewall rules, closing open ports, and securing the wireless network.\\n3. Change the passwords for all user accounts associated with the instance, including the admin account. Make sure to use strong passwords that include a mix of letters, numbers, and special characters.\\n4. Make sure that the Ruckus Wireless Admin software is up-to-date and that all security patches have been installed.\\n5. Monitor the network for any suspicious activity that may indicate a security breach and take appropriate action if necessary.\"\n    },\n    {\n        \"issueTypeId\": \"S7CommServer\",\n        \"remediationGuidance\": \"The standard S7 communication protocol does not use secure communication methods and can be susceptible to session hijacking, denial of service (DoS) attacks, spoofing, and other attacks.\\n\\nA best practice is to make these types of devices accessible to trusted networks only. It is recommended that users protect network access with appropriate mechanisms such as firewalls, segmentation, VPN, etc. In addition to that, organizations should password-protect S7 comms and disallow client connections.\\n\\nPlease follow vendor guidance to configure the operational environment as described in https://www.siemens.com/cert/operational-guidelines-industrial-security.\"\n    },\n    {\n        \"issueTypeId\": \"SapCLM\",\n        \"remediationGuidance\": \"It is generally not recommended to expose SAP Contract Lifecycle Management (CLM) to the public internet. SAP CLM is a business-critical application that contains sensitive information such as contract terms, pricing, and other confidential data. Exposing it to the public internet increases the risk of unauthorized access, hacking, and other security threats. Additionally, the product is impacted by CVE-2022-41273, an open redirect vulnerability.\\n\\nIf you need to access SAP CLM from outside your organization&#39;s network, it is recommended to use a VPN (Virtual Private Network) or other secure remote access solutions. This way, you can ensure that the application is only accessible to authorized users and that all communications are encrypted and secure.\"\n    },\n    {\n        \"issueTypeId\": \"SAPEmployeeSelfService\",\n        \"remediationGuidance\": \"Compromise of SAP Employee Self-Service could lead to an attacker obtaining information about employees and users.\\n1. Evaluate whether this asset should be accessible from the public internet.\\n2. If the asset needs to be accessible from the internet for a business purpose, it is recommended to place the device behind a security tool such as a Web Application Firewall (WAF) with proper logging and alerting in place.\\n3. More information regarding secure settings and configurations can be found at SAP&#39;s documentation https://help.sap.com/docs/HR_RENEWAL_SPV/c05a655202604791bd0d4ab28061f934/19567493c47548ebab752643d9b5a139.html\"\n    },\n    {\n        \"issueTypeId\": \"SapNetWeaverApplicationServer\",\n        \"remediationGuidance\": \"SAP NetWeaver Application Servers if not secured properly can pose a serious security risk to any organization as severe vulnerabilities have been \\nreleased including CVE-2020-6287 allowing for unauthenticated access.\\n\\n1. Identify the exposed SAP NetWeaver Application Servers and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks posed by these trust relationships.\\n3. Ensure that SAP NetWeaver Application Servers are configured to use TLS and Role Based Access Controls (RBAC). If for some reason the SAP NetWeaver Application Servers must be exposed to the internet leverage MFA and place the server behind a Web Application Firewall (WAF).\\n4. Follow SAP best practices and ensure all SAP NetWeaver systems are fully patched. SAP provides guidance https://help.sap.com/docs/SAP_NETWEAVER/9e41ead9f54e44c1ae1a1094b0f80712/576f5c1808de4d1abecbd6e503c9ba42.html?language&#61;en-US.\"\n    },\n    {\n        \"issueTypeId\": \"SAPSolutionManager\",\n        \"remediationGuidance\": \"SAP Solution Manager (SolMan) provides a significant amount of control over an organization\u2019s infrastructure and offers complex access control options that may be difficult to keep track of, which makes it frequently vulnerable to attacks involving authentication bypass attempts. Should such an attack succeed, an attacker could gain critical information about your organization\u2019s SAP suite and use that knowledge to stage larger-scale or more complex attacks.\\n\\nXpanse recommends taking the following steps to secure your SolMan instances:\\n\\n1. Ensure that SolMan is not exposed to the public internet. All instances of Solution Manager should be placed behind a VPN or firewall.\\n2. If Solution Manager is integrated with third-party solutions, it\u2019s critical to keep track of vulnerabilities associated with these products and patch these dependencies promptly.\\n3. Enable logging and tracing using SAP Netweaver Administrator and use this information to track and validate user creation on SolMan. Tracking new users is important because attackers have been known to gain sufficient access to create users with escalated privileges, allowing them to move through SAP SolMan undetected.\"\n    },\n    {\n        \"issueTypeId\": \"SAPSuccessFactors\",\n        \"remediationGuidance\": \"Compromise of SAP SuccessFactors can lead to sensitive data being exfiltrated from your organization.\\n\\n1. Detailed information regarding integration best practices and considerations for SAP SuccessFactors can be found https://blogs.sap.com/2022/04/15/sap-successfactors-employee-data-integration-best-practices-and-considerations/.\\n2. Another option is to look into a Cloud Access Security Broker (CASB) solution to monitor all connections to SAP SuccessFactors and enforce necessary security policies.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricAltivarVariableSpeedDrive\",\n        \"remediationGuidance\": \"Schneider Electric Altivar Variable Speed Drive (VSD) devices could be vulnerable to malicious attacks, such as denial of service or unauthorized access, so they should not be exposed to the public internet. Xpanse recommends placing these devices behind a firewall or VPN and regularly applying firmware and security patches.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricAPCWebSNMPManagementSmartSlotCard\",\n        \"remediationGuidance\": \"The Schneider Electric APC Web SNMP Management SmartSlot Card should not be accessible from the internet because it is used to manage power infrastructure. Exposure to the Internet invites unauthorized access and exploitation attempts from malicious actors. Best practices include ensuring the APC Web SNMP Management Card is behind a firewall and configured to accept SNMP connections only from authorized IP addresses or networks.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricEcoStruxurePowerMonitoringExpert\",\n        \"remediationGuidance\": \"The Power Monitoring Expert Web UI should not be exposed to the Internet, as it displays sensitive information regarding the status and operations of power systems. Role-based access controls should restrict access to only authorized users and, when necessary, remote access should only be possible via a VPN.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricHarmonyGTOSeriesHMI\",\n        \"remediationGuidance\": \"Schneider Electric Harmony GTO Series HMI systems should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Harmony GTO Series HMI systems entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricHarmonyGTUSeriesHMI\",\n        \"remediationGuidance\": \"Schneider Electric Harmony GTU Series HMI systems should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Harmony GTU Series HMI systems entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricHarmonySTUAndSTOSeriesHMI\",\n        \"remediationGuidance\": \"Schneider Electric Harmony STU &amp; STO Series HMI systems should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Harmony STU &amp; STO Series HMI systems entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricMagelisXBTTouchscreenHMI\",\n        \"remediationGuidance\": \"Schneider Electric Magelis XBT Touchscreen HMI should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing the Magelis XBT Touchscreen HMI entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModicon340SeriesPLC\",\n        \"remediationGuidance\": \"Schneider Electric Modicon M340 Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Modicon M340 Series entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModiconEthernetWebModule\",\n        \"remediationGuidance\": \"If an exposed Schneider Electric Modicon Ethernet Web Module is compromised, it can lead to unauthorized access and control of industrial automation systems, data theft, malware infections, DDoS attacks, and reputation damage.\\n\\nIt is recommended to perform the following:\\n1. Disable the default login credentials and change them to strong, unique passwords to prevent unauthorized access.\\n2. Ensure that the module&#39;s firmware is up to date with the latest security patches and updates to address any known vulnerabilities.\\n3. Implement access control measures to restrict access to the module to only authorized personnel, such as IP whitelisting, VPNs, and two-factor authentication.\\n4. Configure the module to use secure communication protocols such as HTTPS and SSL/TLS to encrypt network traffic and prevent eavesdropping and tampering.\\n5. Regularly monitor the module&#39;s network traffic for any suspicious activity that may indicate a potential security breach.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModiconM200SeriesPLC\",\n        \"remediationGuidance\": \"Schneider Electric Modicon M200 Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Modicon M200 Series entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModiconM580SeriesPLC\",\n        \"remediationGuidance\": \"Schneider Electric Modicon M580 Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Modicon M580 entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModiconMC80PLC\",\n        \"remediationGuidance\": \"The exploitation of Schneider Electric Modicon MC80 PLCs could lead to malicious actors interfering with critical operations involved in the management of Concentrated Solar Power (CSP) plants.\\n\\nIt is strongly recommended to implement robust access control policies and ensure Schneider Electric Modicon MC80 PLCs are protected by a firewall or VPN. Additionally, the system should receive regular patches and updates, and inbound and outbound traffic should be closely monitored.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModiconMomentumSeriesPLC\",\n        \"remediationGuidance\": \"The exploitation of ICS devices, such as a Schneider Electric Modicon Momentum PLC, could lead to malicious actors interfering with critical infrastructure or high-stakes automation processes.\\n\\nIt is strongly recommended to implement robust access control policies and ensure Modicon Momentum PLCs are protected by a firewall or VPN. Additionally, the system should receive regular patches and updates, and inbound and outbound traffic should be closely monitored.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricModiconQuantumSeriesPLC\",\n        \"remediationGuidance\": \"Schneider Electric Modicon Quantum PLCs are not meant to be exposed to the public internet, as exploitation could significantly impact critical infrastructure. It is strongly recommended to implement robust access control policies and ensure Schneider Electric Modicon Quantum PLCs are protected by a firewall or VPN. Additionally, these devices should receive regular firmware patches and updates, and inbound and outbound traffic should be closely monitored.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricPowerChute\",\n        \"remediationGuidance\": \"Schneider Electric Power Chute Business Edition enables remote management of power infrastructure and therefore should not be accessible from the public internet. Exposure to the internet invites unauthorized access and exploitation attempts from malicious actors. Best practices include ensuring that the Power Chute Business Edition management console and server are behind a firewall and using strong access controls to restrict user access.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricPowerlinkLightingControlSystem\",\n        \"remediationGuidance\": \"Schneider Electric Powerlink Series Lighting Control System should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing the Powerlink Series Lighting Control System entails the following steps:\\n\\n1. Implement a firewall to prevent unauthorized access from the internet and limit both incoming and outgoing traffic.\\n2. Implement authentication protocols to ensure that only authorized users can access the system.\\n3. Regularly update the system with the latest security patches and software updates.\\n4. Disable any unnecessary services and protocols not required for the system to function.\\n5. Implement network segmentation to isolate the system from other networks.\\n6. Disable unused services: Any unused services should be disabled to reduce the attack surface of the system.\\n7. Monitor the system for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricPowerLogicSeriesPowerMeter\",\n        \"remediationGuidance\": \"Schneider Electric PowerLogic Series Power Meter should not be publicly exposed to the internet. Compromise of the PowerLogic Series Power Meter can impact system availability and loss of sensitive data. Securing Power Meter entails controlling access through a firewall and applying security patches regularly. Additionally, multifactor authentication and strong passwords should be used to protect Power Meter from unauthorized access. Related access logs should also be monitored for any suspicious activity.\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricTwidoSeriesPLC\",\n        \"remediationGuidance\": \"The Schneider Electric Twido Series PLC should not be accessible from the internet because it is commonly used to manage physical control system functionality. Exposure to the Internet invites unauthorized access and exploitation attempts from malicious actors. Best practices include ensuring the Twido Series PLC is behind a firewall and configured to accept connections only from authorized IP addresses or networks.\\n\\n Note: Twido Series PLCs are no longer supported and if these devices reside in your network it is advised by Schneider Electric to upgrade to a Modicon M221 PLC\"\n    },\n    {\n        \"issueTypeId\": \"SchneiderElectricZelioSeriesPLC\",\n        \"remediationGuidance\": \"Schneider Electric Zelio Series PLCs should not be exposed to the internet due to the criticality of the systems they monitor and manage. Securing Schneider Electric Zelio entails the following steps:\\n\\n1. Ensure access to the Zelio Series PLC is restricted by a firewall to limit access to the system from the internet.\\n2. Install a firewall on the Zelio Series PLC to restrict access to the system from the internet and also limit outbound traffic.\\n3. Change the default password of the Zelio Series PLC to a strong and unique password that is not easily guessed.\\n4. Disable any unnecessary services or ports on the Zelio Series PLC.\\n5. Ensure that the Zelio Series PLC is running the latest version of its firmware and that all security patches are applied.\\n6. Utilize network segmentation to limit access to the Zelio Series PLC from other systems on the network.\\n7. Monitor the Zelio Series PLC for any suspicious activity or unauthorized access attempts.\\n8. Utilize secure protocols such as SSH or SFTP for remote access to the Zelio Series PLC.\\n9. Regularly audit the Zelio Series PLC to ensure its security settings are correctly configured.\"\n    },\n    {\n        \"issueTypeId\": \"Section889Violation\",\n        \"remediationGuidance\": \"Investigate the devices that have been flagged under this policy and work with the owner of the affected assets to remove them from your network.\\nFor clarification, Section 889 of the 2019 NDAA prohibits executive agencies from using equipment or services that have been flagged under this policy. (Huawei, Hikvision, Hytera, Dahua, ZTE)\"\n    },\n    {\n        \"issueTypeId\": \"SelfSignedCertificate\",\n        \"remediationGuidance\": \"1. Devices directly accessible from the internet should not be utilizing self-signed certificates. Since these certificates lack signing by a certificate authority (CA) they cannot be revoked or verified easily.\\n2. Identify the device with the self-signed certificate and identify if it should be accessible to the internet.\\n3. To replace a self-signed certificate with one from a certificate authority it is best practice to follow guidelines from the manufacturer, vendor, or internal documentation as this process can vary widely.\"\n    },\n    {\n        \"issueTypeId\": \"ServiceInAdversaryCountry\",\n        \"remediationGuidance\": \"Using services in adversary countries will often allow such governments to access any information stored or sent through such devices and services. If such services are found, locate possible infrastructure located in such areas. These can be previously owned and since relocated systems or devices still included in the network. If found remove such infrastructure.\"\n    },\n    {\n        \"issueTypeId\": \"SharepointServer\",\n        \"remediationGuidance\": \"SharePoint servers are particularly vulnerable to remote code execution attacks, so hardening them to employ the latest best security practices is essential.\\n\\nXpanse recommends securing your organization\u2019s SharePoint servers by taking the following action:\\n\\n1. Implement a Zero-Trust architecture by enabling multi-factor authentication (MFA), limiting external site sharing to only trusted domains, creating IP allow lists, and using conditional access policies to curate user access.\\n2. Install Cumulative Updates monthly and deploy security hotfixes as soon as possible after release.\\n3. Verify that encryption is enabled both in transit and at rest.\\n\\nFor more detailed guidelines, please review https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/security-for-sharepoint-server and https://learn.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort.\"\n    },\n    {\n        \"issueTypeId\": \"ShortKeyCertificate\",\n        \"remediationGuidance\": \"The National Institute of Standards and Technology (NIST) currently recommends that RSA certificate keys use 2048-bit or greater key sizes. CA and OCSP Responder signing RSA keys should have 2048 or 3072 bits. Having smaller keys could allow attackers to crack the certificate before the certificate expires. Additional information may be found in the https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf. Table 2-1 highlights the recommended algorithms and key sizes.\"\n    },\n    {\n        \"issueTypeId\": \"SiemensDesigo\",\n        \"remediationGuidance\": \"The compromise of a Siemens Desigo instance could lead to unauthorized access to building systems, loss of sensitive data, and disruption of critical building functions. Below are some remediation steps that organizations can take to secure their Siemens Desigo installations:\\n\\n1. Minimize network exposure by deploying Desigo behind a firewall and ensure it is not accessible from the Internet. Block unauthorized traffic and regularly monitor network traffic.\\n2. When remote access is required, further limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system and that access is granted on a need-to-know basis.\\n3. Implement multi-factor authentication to prevent unauthorized access and enforce password policies.\\n4. Keep Desigo hardware and software up to date by regularly applying patches and updates in order to address known vulnerabilities.\\n5. Disable unused services in order to limit the attack surface of the platform.\\n\\nFor additional guidance, Xpanse recommends following https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"SiemensPolarionApplicationLifecycleManagement\",\n        \"remediationGuidance\": \"Exploitation of Siemens Polarion could lead to loss of intellectual property, malicious interference with applications managed by Polarion, or could provide an attacker with sufficient information about your organization\u2019s applications to stage more significant, complex attacks.\\n\\nBelow are some remediation steps that organizations can take to secure publicly exposed Siemens Polarion instances:\\n\\n1. Deploy Polarion behind a firewall in order to prevent unauthorized access and regularly monitor network traffic.\\n2. Limit access to the application by configuring access control lists (ACLs) and implementing access through a VPN.\\n3. Implement multi-factor authentication to prevent unauthorized access.\\n4. Keep Polarion up-to-date by regularly applying software patches and updates in order to address known vulnerabilities.\\n\\nFor additional guidance, Xpanse recommends following Siemens\u2019 https://www.siemens.com/cert/operational-guidelines-industrial-security and the https://polarion.plm.automation.siemens.com/hubfs/Docs/Guides_and_Manuals/Polarion_Enterprise_Setup_Guide-2.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"SiemensSimatic\",\n        \"remediationGuidance\": \"If an attacker compromises a Siemens SIMATIC device, they could potentially gain control of the entire industrial process that the device is a part of. This could lead to disruptions in production, damage to equipment, and even harm to personnel.\\n\\nXpanse recommends following these general ICS/SCADA best practices when securing Siemens SIMATIC devices:\\n\\n1. Place remotely accessible devices behind a firewall and ensure they are logically separated from other critical systems, where possible.\\n2. Ensure all applicable software and firmware are updated to use the latest versions and patches.\\n3. Implement strict access control policies that follow the principle of least privilege, meaning that all users should have access only to the essential components that allow them to do their jobs.\\n4. Regularly monitor network activity and user engagement and set up robust alerting.\"\n    },\n    {\n        \"issueTypeId\": \"SipServer\",\n        \"remediationGuidance\": \"SIP servers are common attack vectors for cyber criminals. To maintain a secure SIP server, a number of security measures should be implemented.\\n1. Assess whether the SIP server must be accessible on the public facing internet. If the server must be publicly accessible, require the use of a secure VPN.\\n2. Limit access to the SIP server to trusted sources by implementing an IP Access Control List.\\n3. Enable digest authentication. This will require users to authenticate with a username and password. Ensure chosen passwords are strong and that lockout policies are used.\\n4. Use TLS to ensure that information being sent to and from the server is encrypted.\"\n    },\n    {\n        \"issueTypeId\": \"SitecorePlatform\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed Sitecore Platform server they could compromise sensitive content, inject malicious code, exploit vulnerabilities to access the organization\u2019s network, and steal proprietary information. This unauthorized access can lead to data breaches, privacy violations, reputational damage, and potential legal consequences for the organization.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Isolate the Sitecore Platform server behind a firewall, restricting access to only necessary traffic and implementing network segmentation to protect it from unauthorized access.\\n2. Regularly update the Sitecore Platform software, plugins, and underlying infrastructure to patch known vulnerabilities and maintain a secure environment.\\n3. Implement strong authentication and authorization controls, such as two-factor authentication (2FA), role-based access control (RBAC), and secure password policies.\\n4. Enable encryption for data transmission (e.g., HTTPS) and storage to protect sensitive information from unauthorized access and potential data breaches.\\n5. Monitor the Sitecore Platform server using logging, intrusion detection tools, and security audits to detect and respond to suspicious activities, and maintain security best practices.\"\n    },\n    {\n        \"issueTypeId\": \"SLP\",\n        \"remediationGuidance\": \"Allowing SLP traffic to traverse your network&#39;s external boundary poses a serious security risk. Publicly exposing SLP could allow an attacker to obtain information about services running on your LAN and potentially run exploits against the service.\\n\\nAdditionally, it is worth mentioning that this service is sometimes bundled into software as a part of tool&#39;s service discovery functionality which can have detrimental security impacts should the service be available beyond your LAN. An example of this would be the ransomware attacks against VMware ESXi in February of 2023.\\n\\nThe following steps are recommended if this issue presents in your network:\\n1. Close port 427 and do not allow traffic on this port to leave your environment. \\n2. Review logs to determine if any suspicious activity can be identified from traffic outbound on this port (e.g., suspicious external IPs connecting to SLP, large amounts of egress traffic, anomalous packet data, etc.)\\n3. Develop policies and procedures to prevent future exposures of this service or other risky services.\"\n    },\n    {\n        \"issueTypeId\": \"SmbServer\",\n        \"remediationGuidance\": \"Due to the large number of cyber-attacks targeting SMB, Xpanse recommends that organizations implement the following best practices:\\n\\n**1. Update to the most recent SMB version** to reduce the attack surface area and apply patches promptly. It\u2019s imperative to disable SMBv1 whenever possible, as it does not support encryption and has significant security vulnerabilities. If an organization cannot immediately transition off SMBv1, it is recommended that systems using this protocol should not be publicly accessible and should have strict access control policies.\\n**2. Secure the network perimeter** by blocking connections to all versions of SMB for TCP ports 445 and 139 and UDP ports 137 and 138.\\n**3. Enable encryption for SMB.** SMB v3.0 and up offer end-to-end encryption; however, this is not enabled by default. To enable SMB encryption, review the procedures listed in Microsoft\u2019s SMB security recommendations: https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-security\\n**4. Harden SMB authentication** by requiring unique and complex passwords\\n**5. Restrict SMB traffic** between internal assets to prevent the exploitation of \u201chidden\u201d shares.\\n\\nFurther documentation: https://www.cisa.gov/uscert/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices\"\n    },\n    {\n        \"issueTypeId\": \"SmtpServer\",\n        \"remediationGuidance\": \"Vulnerabilities in the Simple Mail Transfer Protocol (SMTP) can range from data leaks to Remote Code Execution (RCE).\\n1. Best practice is to have a layered SMTP solution, turn off mail relay, and enforce access via an allow-list and/or some form of authentication (SPF, DKIM, DMARC).\\n2. Another approach to take is to configure the SMTP server to communicate solely via SSL.\\n3. It is also recommended to look into security hardening documentation for the specific vendor/SMTP server you are implementing and create a checklist of things to configure.\"\n    },\n    {\n        \"issueTypeId\": \"SnmpServer\",\n        \"remediationGuidance\": \"Simple Network Management Protocol (SNMP) is commonly abused to gain unauthorized access to network devices and as such should not be responding to requests from the public internet.\\n\\n1. Update to the most recent SNMPv3 version to reduce the attack surface area and apply patches promptly. It\u2019s imperative to disable SNMPv1 and SNMPv2 whenever possible, as it does not support encryption and has significant security vulnerabilities. \\n2. Secure the network by blocking outbound SNMP responses on UDP ports 161 and 162.\\n3. It is recommended to combine SNMPv3 with management information base (MIB) allow-listing using SNMP views.\\n4. SNMP security best practices from CISA can be followed https://www.cisa.gov/uscert/ncas/alerts/TA17-156A\"\n    },\n    {\n        \"issueTypeId\": \"SolarViewCompact\",\n        \"remediationGuidance\": \"SolarView Compact is susceptible to several security vulnerabilities, including CVE-2022-29303, a command injection vulnerability included in CISA&#39;s BOD 22-01.\\n\\nIf attackers gain access to a SolarView Compact device, they could access and manipulate the solar power generation data, leading to inaccurate reporting and monitoring. Additionally, they may intentionally tamper with the device\u2019s settings or functionality, causing disruptions in solar power generation, measurement, and overall system performance.\\n\\nTo keep SolarView Compact devices secure, Xpanse recommends performing the following:\\n\\n1. Implement proper access controls such as strong authentication, unique usernames and passwords, and user access restrictions.\\n2. Ensure the SolarView Compact device is running the latest firmware to address any known security vulnerabilities.\\n3. Place the device in a separate network segment, isolating it from critical systems and reducing the risk of lateral movement in case of a breach.\\n4. Continuously monitor the device for suspicious activity and set up alerts for potential security events.\\n5. Periodically review SolarView Compact\u2019s security guidelines and apply recommended best practices to maintain a secure environment.\"\n    },\n    {\n        \"issueTypeId\": \"SolarWindsOrionPlatform\",\n        \"remediationGuidance\": \"The SolarWinds breach was a multi-part, sophisticated attack that involved the distribution of the SUNBURST backdoor. SUNBURST is a digitally signed malware that was embedded into a SolarWinds plugin, allowing attackers to move laterally within an organization\u2019s network when the backdoor is executed. The impacted versions are 2019.4 HF 5,2020.2 with no patch installed or 2020.2 HF 1. If any of those versions are running, upgrading to 2020.2.1 HF 2 or above is imperative.\\n\\nSince SUNBURST is digitally signed and looks legitimate, assessing the impact of this intrusion could be complex. Follow CISA\u2019s recommended process for remediating malicious activity caused by SUNBURST. Your organization can also investigate potential SUNBURST activity using the https://unit42.paloaltonetworks.com/atoms/solarstorm/\\n\\nFurther documentation:  https://www.cisa.gov/uscert/ncas/current-activity/2021/03/09/guidance-remediating-networks-affected-solarwinds-and-active\"\n    },\n    {\n        \"issueTypeId\": \"SonatypeNexusRepositoryManager\",\n        \"remediationGuidance\": \"Xpanse recommends following the vendor&#39;s https://help.sonatype.com/repomanager3/planning-your-implementation for properly configuring Nexus instances. It is strongly recommended that Nexus instances are only accessible through a reverse proxy.\"\n    },\n    {\n        \"issueTypeId\": \"SonicWallEmailSecurity\",\n        \"remediationGuidance\": \"To secure SonicWall Email Security instances, it is recommended to perform the following:\\n\\n1. Isolate SonicWall Email Security instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all SonicWall Email Security instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that SonicWall Email Security instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on SonicWall Email Security instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"SonicWallSecureMobileAccessVpn\",\n        \"remediationGuidance\": \"SonicWall Secure Mobile Access VPN is a frequent target of sophisticated attacks by malicious actors, and therefore, its access to the public internet should be as restricted as possible. To secure your instances of SMA, Xpanse recommends implementing a Zero-Trust architecture and staying up-to-date on the latest patches:\\n\\n1. Configure the Network Tunnel Service to manage access to the appliance. Using the network tunnel service with configured IP address pools is a security best practice for VPNs because it gives organizations visibility into traffic for their remote users. This configuration helps with proactively detecting intruders and containing attacks for remote users. Please note that split tunneling is not recommended as it may lead to critical data being intercepted by malicious actors. Xpanse instead recommends using the Redirect All configuration mode.\\n2. Set up Zones of Trust to secure traffic from the configured network tunnel and assign user groups, realms, and communities to the appropriate zones to reduce your organization\u2019s attack surface.\\n3. Closely monitor traffic logs by looking at the egress traffic captured in appliance logs. Should logs be redirected to syslog, ensure that no critical data is transmitted as syslog communications are not encrypted.\\n4. Enable 2FA for all users. This product can be integrated with RSA *SecurID* Access using RADIUS.\\n5. Employ End Point Control components to verify that a user\u2019s environment is secure and to protect sensitive data.\\n\\nMore information can be found in the https://www.sonicwall.com/support/technical-documentation/docs/sma_100-10-2-administration_guide/Content/sma-app-best-practices.htm/.\"\n    },\n    {\n        \"issueTypeId\": \"SonicWallSecureRemoteAccess\",\n        \"remediationGuidance\": \"SonicWall Secure Remote Access (SRA) is no longer supported by the vendor. This means the application does not recieve security updates/patches and is likely to contain security vulnerabilities. Removing deprecated and unsupported applications reduces the attack surface, and is recommended as a best practice for Internet facing targets.\"\n    },\n    {\n        \"issueTypeId\": \"SonicWallSonicOS\",\n        \"remediationGuidance\": \"Determine whether this asset should be exposed to the public internet or not.\\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"SophosSGSeriesFirewall\",\n        \"remediationGuidance\": \"Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\\n\\nXpanse recommends performing the following steps to keep firewall devices secure:\\n\\n1. Ensure the firewall\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts.\"\n    },\n    {\n        \"issueTypeId\": \"SophosXGSeriesFirewall\",\n        \"remediationGuidance\": \"Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\\n\\nXpanse recommends performing the following steps to keep firewall devices secure:\\n\\n1. Ensure the firewall\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts.\"\n    },\n    {\n        \"issueTypeId\": \"SpinnakerWebServer\",\n        \"remediationGuidance\": \"Spinnaker is a continuous-delivery platform for managing and releasing software that has known vulnerabilities that when exploited could provide access to internal infrastructure.\\n1. Identify all instances of Spinnaker Web Server and leverage a layered security approach including firewalls, encryption, roles, ACLs, and strong authentication practices.\\n2. Security best practices can be followed from Spinnaker https://spinnaker.io/docs/setup/other_config/security/\"\n    },\n    {\n        \"issueTypeId\": \"SslTlsCbcCipher\",\n        \"remediationGuidance\": \"1. The Cipher Block Chaining (CBC) cipher suite found in older versions of SSL and TLS is vulnerable to numerous security vulnerabilities including the BEAST and POODLE attacks.\\n2. Determine which version of SSL and or TLS is being used in the environment and the CBC cipher suite. Where possible upgrade to a more secure version of TLS that allows for the Authenticated Encryption with Additional Data (AEAD) cipher suite.\\n3. If disabling SSLv3 is not tenable, then it is strongly encouraged to use the TLS_FALLBACK_SCSV signal. This protocol extension must be supported both client-side and server-side to be fully functional. More information can be found at: https://www.kb.cert.org/vuls/id/577193\"\n    },\n    {\n        \"issueTypeId\": \"SugarCRM\",\n        \"remediationGuidance\": \"There are a number of security flaws associated with specific versions of SugarCRM. For example, CVE-2023-22952 could lead to remote code execution for SugarCRM versions 11.0.0 through 11.0.4. To ensure your organization remains secure:\\n\\n* Determine if this specific instance of SugarCRM must be accessible on the internet. If not, work with the asset owner to remove public access.\\n* Upgrade to the latest secure version of SugarCRM. Details on supported and EOL versions can be found on the https://support.sugarcrm.com/Resources/Supported_Versions/.\\n* Consider using a web application firewall (WAF) to protect against attacks and to limit access to approved devices.\"\n    },\n    {\n        \"issueTypeId\": \"SumavisionRouterEnhancedMultimediaRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"SymantecEndpointProtectionManager\",\n        \"remediationGuidance\": \"Symantec Endpoint Protection Manager is a system to manage Symantec Endpoint Protection clients from a web console.\\n* It is recommended to determine whether this interface should be exposed to the public Internet.\\n* If the application needs to be exposed to the public internet, it is recommended to require two-factor authentication for all users.\\n* More information regarding configuration and best practices can be found in the official documentation https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Related-Documents.html under &#34;Installation and Administration Guide&#34; for the version being used.\"\n    },\n    {\n        \"issueTypeId\": \"SymantecMessagingGateway\",\n        \"remediationGuidance\": \"To secure Symantec Messaging Gateway instances, it is recommended to perform the following:\\n\\n1. Isolate Symantec Messaging Gateway instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Symantec Messaging Gateway instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Symantec Messaging Gateway instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Symantec Messaging Gateway instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"SynacorZimbraCollaborationSuite\",\n        \"remediationGuidance\": \"1. Evaluate if Zimbra Collaboration Suite by Synacor Plus should be directly accessible from the internet.\\n2. Ensure the management interface is not exposed to the internet.\\n3. Where possible restrict access and ensure multifactor authentication (MFA) is enforced.\\n4. Further mitigation advice can be followed from CISA https://www.cisa.gov/uscert/ncas/alerts/aa22-228a\"\n    },\n    {\n        \"issueTypeId\": \"SynologyVPNPlusServer\",\n        \"remediationGuidance\": \"VPN clients should be monitored closely, as they can provide threat actors a foothold into an organization&#39;s network. Synology VPN Plus Server comes equipped with a number of different settings that can help secure the device:\\n\\n1. Utilize VPN Plus Server&#39;s traffic monitoring functionality. Setup alerts that trigger on suspicious behavior.\\n2. Carefully manage user permissions, and limit access to the VPN only to trusted users.\\n3. Work with IT to ensure this device is using a secure protocol. Certain protocols may require more maintenance than others. For instance, it is recommended to not use PPTP due to security concerns.\"\n    },\n    {\n        \"issueTypeId\": \"TeleconferencingAndCollaboration\",\n        \"remediationGuidance\": \"Teleconferencing and collaboration devices provide access to highly sensitive information and are are often targeted by malicious actors. As such, they should be the subject of security hardening.\\n\\n1. Identify the exposed teleconferencing and collaboration devices and evaluate if there is any PII or sensitive information on the appliance to understand the impact.\\n2. Maintain teleconferencing and collaboration systems behind a firewall or through a VPN.\\n3. If your organization&#39;s teleconferencing and collaboration devices need to be exposed to the internet, then using high-entropy passwords, role-based access, encryption, lockout policy, and traffic inspection is recommended.\\n4. Teleconferencing and collaboration devices security best practices from CISA can be followed https://www.cisa.gov/sites/default/files/publications/CISA_Guidance_for_Securing_Video_Conferencing_S508C.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"TelerikWebUI\",\n        \"remediationGuidance\": \"Telerik Web UI components are vulnerable to several critical vulnerabilities that have been exploited by known threat actors, such as https://nvd.nist.gov/vuln/detail/CVE-2019-18935. Successful exploitation of Telerik vulnerabilities could lead to remote code execution, and attackers may be able to gain full access to the application.\\n\\nXpanse recommends updating Telerik to the latest version. More security mitigations are available in https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a.\"\n    },\n    {\n        \"issueTypeId\": \"TelnetServer\",\n        \"remediationGuidance\": \"1. Best practice is to not have Telnet exposed to the internet and where possible replace with Secure Shell (SSH).\\n2. Evaluate if there is any PII or sensitive information on the appliance to understand the impact of Telnet transmitting unencrypted information.\\n3. Evaluate all devices utilizing Telnet and take a risk-based approach around the need for Telnet.\\n4. Where possible replace existing Telnet usage with SSH. If this is not feasible follow recommended guidelines set forth by the manufacturer to mitigate Telnet exposure.\"\n    },\n    {\n        \"issueTypeId\": \"TenableNessus\",\n        \"remediationGuidance\": \"Tenable Nessus has a number of associated CVEs including CVE-2022-32973, which could lead to threat actors executing commands with administrator privileges. Exploitation could lead to sensitive data exposure.\\n\\nIt is recommended that organizations remove all publicly accessible instances of Nessus, unless there is a clear business need.\\nUpgrade Nessus to the latest secure version. Release information can be found with the https://docs.tenable.com/Nessus.htm.\"\n    },\n    {\n        \"issueTypeId\": \"TenableSC\",\n        \"remediationGuidance\": \"Tenable.sc is vulnerable to a number of XSS(CVE-2023-24494), SSRF(CVE-2023-24495), LDAP injection(CVE-2023-0476), and formula injection(CVE-2023-24493) exploits. In order to remain secure:\\n\\n* Upgrade to the latest version of Tenable.sc.\\n* Determine if this asset should be accessible on the public internet. In most cases, Tenable.sc should only be accessible on an internal, monitored network.\\n* https://www.tenable.com/security should be actively monitored for critical updates.\"\n    },\n    {\n        \"issueTypeId\": \"TendaRouter\",\n        \"remediationGuidance\": \"Routers are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"TftpServer\",\n        \"remediationGuidance\": \"In most cases, TFTP should not be used because it provides no built in security or authentication mechanisms. Therefore, the recommended course of action is to immediately remove TFTP from public access. Consider implementing a more secure file transfer protocol, such as FTPS or SFTP.\\n\\nhttps://datatracker.ietf.org/doc/html/rfc7440#section-7 details security risks associated with TFTP and possible workarounds.\"\n    },\n    {\n        \"issueTypeId\": \"ThinkPHPApplication\",\n        \"remediationGuidance\": \"To secure ThinkPHP applications, it is recommended to perform the following:\\n\\n1. Isolate ThinkPHP applications from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all ThinkPHP applications should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that ThinkPHP applications are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on ThinkPHP applications. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ThreeCXIPPhoneSystem\",\n        \"remediationGuidance\": \"Exposing 3CX Phone System to the public internet makes organizations vulnerable to Denial of Service (DoS), brute force attacks, and man-in-the-middle (MitM) attacks.\\n\\nXpanse recommends taking the following steps to remediate exposed instances of 3CX IP Phone System:\\n\\n1. Minimize network exposure by deploying 3CX behind a firewall and ensure it is not accessible from the internet. Block unauthorized traffic and regularly monitor network traffic.\\n2. When remote access is required, further limit access to the system by configuring access control lists (ACLs) and implementing access through a VPN. Ensure that only authorized personnel have access to the system and that access is granted on a need-to-know basis.\\n3. Keep 3CX hardware and software up to date by regularly applying patches and updates in order to address known vulnerabilities.\\n4. Disable unused integrations to limit the platform&#39;s attack surface.\"\n    },\n    {\n        \"issueTypeId\": \"TibcoJasperServer\",\n        \"remediationGuidance\": \"TIBCO JasperServer is vulnerable to a number of CVEs, including CVE-2018-5430 and CVE-2018-18809, two improper path traversal vulnerabilities. Exploitation could lead to a threat actor viewing arbitrary files on the server. To best protect your organization:\\n1. Configure the security settings in TIBCO JasperServer to restrict access to sensitive data and features. For example, limit user access to reports and dashboards based on their roles and responsibilities.\\n2. Implement security best practices, such as strong passwords, two-factor authentication, and regular security audits. Train users on how to recognize and report security incidents.\\n3. Monitor your TIBCO JasperServer instance for any unusual activity or signs of a security breach. Use logging and monitoring tools to track user activity and detect potential threats.\\n4. Upgrade to the latest secure version of JasperServer.\"\n    },\n    {\n        \"issueTypeId\": \"TikTokPixel\",\n        \"remediationGuidance\": \"Although its stated purpose is to measure the effectiveness of online advertising, the TikTok pixel tracker collects data indiscriminately across the public internet for both TikTok users and non-users. Having the TikTok Pixel configured on your organization\u2019s assets or allowing its tracker to collect data from your organization\u2019s domains carries a significant risk of critical information being harvested or leaked.\\n\\nEven though TikTok provides different tiers of data protection, no configuration of the TikTok Pixel is considered safe, and it is strongly recommended to discontinue using this tool.\\n\\nTo block TikTok from using the Pixel trackers on your assets, Xpanse recommends placing these assets behind a VPN so they\u2019re no longer publicly accessible. If a business case requires these assets to be public, then it is best practice to use a firewall rule to monitor and block traffic from TikTok, which would include attempts by the TikTok Pixel to collect data.\"\n    },\n    {\n        \"issueTypeId\": \"TomcatWebServer\",\n        \"remediationGuidance\": \"Tomcat web servers are vulnerable to numerous types of attacks, the most impactful being DoS and information disclosure vulnerabilities such as https://nvd.nist.gov/vuln/detail/CVE-2023-34981 and https://nvd.nist.gov/vuln/detail/CVE-2021-30639. A compromised Tomcat web server may lead to significant service interruptions and potential data leaks of internal server information.\\n\\nTo keep Tomcat web servers secure, it is recommended to perform the following:\\n\\n1. Isolate Tomcat web servers from the public internet by placing them behind a VPN.\\n2. If a strong business case exists for public accessibility, all Tomcat web servers should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Tomcat web instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Tomcat instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"TPLinkDevice\",\n        \"remediationGuidance\": \"Routers and networking infrastructure are expected to be internet-facing. However, these devices can be breached through authentication/authorization bypass attacks and may provide privileged access to an enterprise network.\\n\\nXpanse recommends performing the following steps to remain secure:\\n\\n1. Ensure the router\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the router\u2019s firmware by installing the vendor\u2019s latest versions. Actively monitor the latest security patches and apply them as soon as possible.\\n3. Replace the default username and password with robust, unique credentials.\\n4. Turn off remote management features to prevent unauthorized external network access.\\n5. Regularly review the router logs to identify any suspicious activity or unauthorized access attempts.\\n6. Place the router behind appropriate security tooling, such as a firewall. Only necessary ports should be open, and running services should be audited regularly.\"\n    },\n    {\n        \"issueTypeId\": \"TrellixEnterpriseSecurityManager\",\n        \"remediationGuidance\": \"Trellix Enterprise Security Manager is exposed to CVE-2023-3314, a high severity command injection vulnerability. In order to maintain network security Xpanse recommends the following:\\n\\n1. Remove instances of Trellix Enterprise Security Manager from the public facing internet. This software should be reserved for internal use only for authorized users.\\n2. Upgrade to the latest secure version. Upgrading to version 11.6.7 will protect against CVE-2023-3314.\\n3. Restrict access to the application to approved users on a minimum access policy. This will prevent threat actors who may have infiltrated your internal environment from escalating their privileges.\\n4. Visit the vendor https://kcm.trellix.com/corporate/index?page&#61;content&amp;id&#61;SB10403 for CVE-2023-3314 for further information and mitigation techniques.\"\n    },\n    {\n        \"issueTypeId\": \"TrendIWSVirtualGateway\",\n        \"remediationGuidance\": \"It is recommended to evaluate whether this device should be exposed to the public internet. If it is found that this device should not be exposed, identify the asset owner and work with them to remove the device from being accessible from the public internet.\"\n    },\n    {\n        \"issueTypeId\": \"UbiquitiDevice\",\n        \"remediationGuidance\": \"There are a number of CVEs associated with Ubiquiti devices, notably CVE-2020-8234 which can lead to command injection. Specific security recommendations will depend on the identified product.\\n\\nWhile networking devices are generally expected to be on the public facing internet:\\n\\n* Ensure that you are running the latest security update.\\n* Monitor the device for malicious traffic.\\n* If applicable, implement an access control list to only allow trusted devices to connect to the Ubiquiti device.\"\n    },\n    {\n        \"issueTypeId\": \"UnclaimedGoogleAppEngineServices\",\n        \"remediationGuidance\": \"It is recommended to remove the CNAME record that points to the unclaimed Google App Engine service in order to remediate this issue.\"\n    },\n    {\n        \"issueTypeId\": \"UnclaimedS3Bucket\",\n        \"remediationGuidance\": \"Unclaimed Amazon S3 Buckets lead to subdomain takeover, which often happens when a developer or engineer removes a cloud resource but does not delete the corresponding DNS record.\\n\\n1. DNS records should be reviewed on a regular basis. Stale and unused DNS entries should be identified and removed.\\n2. The practice of reviewing DNS records should be included in the workflow of engineering or development teams whenever a service is discontinued to ensure all associated DNS entries, hostnames, and subdomains are removed.\"\n    },\n    {\n        \"issueTypeId\": \"UnencryptedFtpServer\",\n        \"remediationGuidance\": \"1. Identify the service owner and business purpose.\\n 2. Evaluate if there is any PII or sensitive information on the server to understand the impact of the FTP Server transmitting unencrypted information.\\n 3. Evaluate if this FTP Server needs to be exposed to the public internet for business purposes.\\n 4. If the server does need to be exposed to the public internet or an internal network, Xpanse recommends reconfiguring the server to only accept encrypted FTPS connections or decommissioning the FTP Server and switching to a more modern secured and encrypted file transfer technology.\\n 5. If the server does not need to be exposed, it should be decommissioned and removed from the network.\"\n    },\n    {\n        \"issueTypeId\": \"UnencryptedLogin\",\n        \"remediationGuidance\": \"Insecure login forms make your organization vulnerable to interception attacks. Secure this process by serving login landing pages over HTTPS with HSTS enabled. This will prevent attackers from stealing plain text credentials by sniffing the network or interfering with the page in transit.\\n\\nFurther documentation:\\n * https://developer.mozilla.org/en-US/docs/Web/Security/Insecure_passwords\\n * https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html\"\n    },\n    {\n        \"issueTypeId\": \"UpnpServer\",\n        \"remediationGuidance\": \"Unpatched, misconfigured, and public facing UPnP Servers pose a serious security risk. This is primarily due to the lack of authentication performed by UPnP.\\n\\nDo not utilize UPnP if possible. Instead manually port forward services and devices in your network as needed.\\n\\nIf your organization requires the use of UPnP take the following steps to mitigate risk:\\n1. Ensure the services are not publicly accessible.\\n2. Ensure robust logging is enabled on the asset hosting the UPnP services and your network devices to monitor for nefarious activities such as data exfiltration, malware delivery, staging, rogue services, etc.\\n3. Place UPnP behind network security devices on your edge (such as WAFs) and enable monitoring on these devices along with DDoS mitigation and allow-listing functions.\"\n    },\n    {\n        \"issueTypeId\": \"VeeamBackupAndReplication\",\n        \"remediationGuidance\": \"Veeam Backup and Replication is vulnerable to CVEs such as CVE-2023-27432, which allows encrypted credentials to be stolen. If you have identified a publicly exposed Veeam Backup and Replication server, here are some steps you can take to remediate the situation:\\n\\n1. Immediately disconnect the server from the internet to prevent any further unauthorized access.\\n2. Conduct a thorough security assessment of the server to identify any potential vulnerabilities and determine if any data has been compromised.\\n3. Apply all necessary security patches and updates to the server and ensure that all software and applications are up to date.\\n4. Implement strong authentication and access controls to prevent unauthorized access.\\n5. Consider implementing additional security measures such as firewalls, intrusion detection and prevention systems, and data encryption.\\n6. Regularly monitor the server for any suspicious activity or unauthorized access attempts.\\n\\nVendor recommendations can be found https://bp.veeam.com/vbr/Security/.\"\n    },\n    {\n        \"issueTypeId\": \"VeritasDevice\",\n        \"remediationGuidance\": \"Certain Veritas devices are vulnerable to high impact CVEs. Some of the most notable vulnerabilities are CVE-2022-42307 and CVE-2022-46414, an XML external entity (XXE) injection attack and an unauthenticated remote command execution (RCE) attack respectively.\\n\\nIt is recommended to identify the device&#39;s specific product / model in order to determine vulnerability and remediate the risk.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareCarbonBlackAppControl\",\n        \"remediationGuidance\": \"VMware Carbon Black App Control should not be accessible on the public internet. If breached, it could allow attackers to gain detailed information about an organization&#39;s network. Specific versions of VMware Carbon Black App Control are vulnerable to an authentication bypass, remote code execution and file upload exploits via CVE-2021-21998, CVE-2022-22951 and CVE-2022-22952 respectively. VMware security advisories, including those affecting VMware Carbon Black App Control, can be found https://www.vmware.com/security/advisories.html.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareCloudDirector\",\n        \"remediationGuidance\": \"VMware Cloud Director is vulnerable to a number of CVEs including CVE-2022-22966, which can lead to remote code execution. While VMware Cloud Director tenant portals are expected to be public facing, ensure the instance is running the latest security patches.\\n\\nDetailed security recommendations can be found in the https://docs.vmware.com/en/VMware-Cloud-Director/Security/VMwre_Cloud_Director_Security_Guide.pdf.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareESXi\",\n        \"remediationGuidance\": \"Compromise of an ESXi server can lead to an attacker gaining control of large aspects of an organizations infrastructure as these devices are typically used as a hypervisor to host a wide variety of Virtual Machines (VMs).\\n\\nIdeally, this system should not be exposed to the internet at all.\\nIf it needs to be exposed for a business reason, it is recommended to put the device behind security controls such as a Web Application Firewall (WAF) with appropriate logging and alerting enabled.\\n\\nFurther security recommendations can be found in VMware&#39;s documentation https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-B39474AF-6778-499A-B8AB-E973BE6D4899.html. Ensure that the flagged version matches the version listed in the documents.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareSpringFramework\",\n        \"remediationGuidance\": \"Specific environments of the Spring Core Framework contain a remote code execution vulnerability, steps to reduce the probability of such attempts include the following:\\n\\n1. Evaluate whether the vulnerability exists on your system. Information on the requirements for exploitation of the vulnerability can be found at https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#am-i-impacted.\\n2. Best practice is to update to current versions, as outdated versions may no longer get security updates on a regular basis and are prime targets for attackers. It is recommended to upgrade to the latest version of Spring Framework. Latest updates can be found at https://spring.io/blog/category/releases.\\n3. If incremental updates cannot be achieved, temporary workarounds include: updating Apache Tomcat to 10.0.20, 9.0.62, or 8.5.78; downgrading to java 8, if upgrading the Spring Framework or Apache Tomcat is not possible; as well as disabling binding to certain fields by setting the disallowedFields option. This is explained in more detail at https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareUnifiedAccessGateway\",\n        \"remediationGuidance\": \"If you have discovered an exposed and vulnerable instance of VMware Unified Access Gateway, you should take the following steps to remediate the vulnerability:\\n\\n1. Quarantine the vulnerable device to prevent further potential exploits, lateral movement, data loss, or footholds in your environment.\\n2. Identify the specific vulnerability affecting the instance of VMware Unified Access Gateway.\\n3. Once you have identified the vulnerability, apply any available patches or updates to the instance of VMware Unified Access Gateway to remediate the vulnerability.\\n4. Ensure that the instance of VMware Unified Access Gateway is configured with appropriate security settings, such as SSL encryption, two-factor authentication, and access controls.\\n5. Review logs associated with the device to include network logs, application logs, IPS/IDS logs, EDR logs, OS logs, etc. to determine if any compromise as a result of the vulnerable VMware UAG took place. Then contain, eradicate, and remediate appropriately.\\n6. Continue to monitor all instances of VMware Unified Access Gateway for future vulnerabilities and apply patches and updates as necessary to ensure ongoing proficient security.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareVCenterAdminPage\",\n        \"remediationGuidance\": \"Identify the owner of the affected asset and determine if there is a legitimate business need to have this service exposed to the internet.\\nIf not, work with the asset owner to remove the device from the internet.\\n\\nIf the device has a legitimate business need to be exposed to the internet, it is best practice to enable Two-Factor Authentication / Single Sign-on.\\nDocumentation for setup can be found here: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-ACFFCBEC-6C1C-4BF9-9971-04AEE9362AFE.html\\nEnsure document version matches the one displayed in the affected asset\"\n    },\n    {\n        \"issueTypeId\": \"VMwareVRealizeAutomationAppliance\",\n        \"remediationGuidance\": \"Due to the network access provided by VMware vRealize Automation, it is recommended for instances of VMware vRealize Automation to not be accessible to the public Internet unless there is a business need.\\nXpanse recommends working to identify the asset owner and collaborating with them to remove the asset from the internet.\"\n    },\n    {\n        \"issueTypeId\": \"VMwarevRealizeLogInsight\",\n        \"remediationGuidance\": \"VMware Aria Operations for Logs (formerly VMware vRealize Log Insight) if left unpatched or misconfigured poses a significant security risk to your organization. Log Insight has had recent vulnerability disclosures that include cross-site scripting. It is recommended to take the following steps to secure your instance of VMware vRealize Log Insight:/n/n1. Ensure you are running the latest available version of Log Insight./n2. Ensure your instance of VMware vRealize Log Insight is not publicly visible./n3. If your instance of VMware vRealize Log Insight must be public facing, ensure it lies behind security devices such as a Palo Alto&#39;s Prisma Access./n4. Ensure you have verbose logging on VMware vRealize Log Insight to detect nefarious activities should they take place.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareVRealizeNetworkInsight\",\n        \"remediationGuidance\": \"VMware vRealize Network Insight is vulnerable to CVE-2022-31702 and CVE-2022-31703, which are command injection and directory traversal vulnerabilities respectively. Due to this:\\n1. Ensure that the vRealize Network Insight (vRNI) installation is up to date with the latest version.\\n2. Review the vRNI system logs for any errors or warnings.\\n3. Implement security best practices for vRNI, such as using strong passwords, restricting access to only authorized users, and enabling two-factor authentication.\\n4. Monitor the vRNI system for any suspicious activity or unauthorized access.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareVRealizeOperations\",\n        \"remediationGuidance\": \"Determine whether this asset should be exposed to the public internet or not.\\nAfterwards, work with the asset owner to restrict access should it be determined that the asset should not be publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"VMwarevRealizeOrchestrator\",\n        \"remediationGuidance\": \"If an attacker gains access to a VMware vRealize Orchestrator (vRO) instance, they can access sensitive information, disrupt services, modify workflows, spread malware, and escalate privileges within the VMware environment. This puts the organization&#39;s data, operations, and network at risk.\\n\\nIt is recommended to perform the following in order to remain secure:\\n1. Restrict vRO access by placing it in a secure network zone and allowing only authorized connections.\\n2. Implement strong, unique credentials, multi-factor authentication, and enforce least privilege access.\\n3. Enable encryption for data in transit (using TLS) and data at rest (e.g., vSAN encryption).\\n4. Regularly update and patch vRO, underlying OS, and integrated components to address security vulnerabilities.\\n5. Configure logging, monitor for suspicious activities, apply VMware&#39;s security hardening guidelines, and perform regular security assessments.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareWorkspaceOneAccessServer\",\n        \"remediationGuidance\": \"VMware Workspace ONE Access has been impacted by a number of security vulnerabilities, including Log4Shell. To protect against these security risks:\\n\\n* Determine if this instance of VMware Workspace ONE Access must be accessible on the public internet. If not, work with the asset owner to limit access.\\n* Determine which version is being run. VMware Workspace ONE Access does not always broadcast version information. If this instance is running an old patch upgrade to the latest secure version.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareWorkspaceOneAdministrativeConfigurator\",\n        \"remediationGuidance\": \"This issue identifies the web administration portals of VMware Identity Manager and Workspace ONE Access. Version numbers are identified where available.\\n\\nPer CVE-2020-4006, VMWare Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a Command Injection Vulnerability in the administrative configurator. A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system. This account is internal to the impacted products and a password is set at the time of deployment. A malicious actor must possess this password to attempt to exploit CVE-2020-4006.\\n\\nThe NSA, FBI, and CISA identified VMware Workspace One Access on April 15, 2021, as a service impacted by one of the five vulnerabilities most frequently targeted by Russian SVR cyber operations.\"\n    },\n    {\n        \"issueTypeId\": \"VMwareWorkspaceONEUEM\",\n        \"remediationGuidance\": \"VMware Workspace One UEM when misconfigured and/or unpatched poses a security risk to your organization. Take the following steps to secure your instance of Workspace One UEM:\\n\\n1. Ensure your instance of Workspace One UEM is updated to the latest available version.\\n2. Place Workspace One UEM behind security tools such as a WAF.\\n3. Do not make access to Workspace One UEM public.\"\n    },\n    {\n        \"issueTypeId\": \"VncServer\",\n        \"remediationGuidance\": \"In general, VNC should not be directly exposed to the Internet as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.\\nThe following should be evaluated and performed:\\n\\n1. Disable or remove the service from the internet.\\n2. Review whether VNC is absolutely necessary and see if tunneling VNC over SSH or a VPN can be utilized instead.\\n3. Use VNC implementations that encrypt the entire VNC session, including password authentication and data transfer.\"\n    },\n    {\n        \"issueTypeId\": \"VpnDevice\",\n        \"remediationGuidance\": \"VPN Devices are expected to be publicly accessible. To improve network security, consider the following:\\n\\n* Monitor the VPN for for anomalous behavior.\\n* Consider implementing access control lists to ensure only trusted users are able to access the device.\\n* Enforce strong passwords, and ensure there are lockout mechanisms in place.\\n* Run the latest security patches.\"\n    },\n    {\n        \"issueTypeId\": \"WatchGuardFirebox\",\n        \"remediationGuidance\": \"If for any reason it is determined that this device should not be publicly exposed to the internet, identify the asset owner and work to restrict access to the device.\"\n    },\n    {\n        \"issueTypeId\": \"WatchGuardXtmAppliance\",\n        \"remediationGuidance\": \"Instances of WatchGuard XTM are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly configured WatchGuard XTM appliance could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\\n\\nXpanse recommends performing the following steps to keep instances of WatchGuard XTM secure:\\n\\n. Ensure WatchGuard XTM\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update WatchGuard XTM devices to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\\n3. Audit open ports and running services and ensure that anything active is critical for firewall and VPN functionality to run effectively and safely.\\n4. Monitor WatchGuard XTM traffic to identify suspicious activity or unauthorized access attempts.\"\n    },\n    {\n        \"issueTypeId\": \"Weaveworks\",\n        \"remediationGuidance\": \"Having a misconfigured or unpatched instance of Weave Scope or GitOps poses a serious risk to your organization. Both products offered by Weave contain sensitive information that should never be publicly exposed. The following steps are recommended to secure your Weave products:\\n\\n1. Ensure you do not have any instance of Weave Scope or GitOps publicly accessible.\\n2. Ensure access to your instance of Weave Scope or GitOps are behind security devices such as a WAF.\\n3. Ensure you have verbose logging enabled on your Weave products to detect threats involving these products to your organization.\\n4. Ensure you are utilizing best practices for access control to these tools.\"\n    },\n    {\n        \"issueTypeId\": \"WebLogin\",\n        \"remediationGuidance\": \"This policy flags all login pages that are publicly exposed on the internet, including user and admin logins. Login panels are not inherently vulnerable, but having them publicly accessible poses significant security risks, like being breached or leaking sensitive information.\\n\\nXpanse recommends that all servers hosting login landing pages in your organization are placed behind a Web Application Firewall (WAF) and not publicly accessible.\\n\\nIf it is determined that a particular server exposing login pages does need to be publicly exposed, then it is recommended to take the following steps to secure your login interfaces:\\n\\n1. Ensure that login landing pages are served over HTTPS with HSTS enabled. This security measure will prevent attackers from stealing plain text credentials by sniffing the network or interfering with the page in transit.\\n2. Review password policies and disable default passwords that can be easily guessed or discovered.\\n3. Review access policies and ensure the principle of least privilege is applied in existing controls.\\n4. Implement input validation and sanitization to prevent cross-scripting and SQL injection attacks.\\n5. Ensure the application isn\u2019t leaking internal information that would give enough context to an attacker to brute-force their way into the system (like user-enumeration). Failed logins should not expose more details other than the failure itself; how and what failed should not be explained in more detail either in the user-facing messaging or in the application logs.\\n\\nMore detailed guidelines can be found in the https://owasp.org/www-community/OWASP_Application_Security_FAQ.\"\n    },\n    {\n        \"issueTypeId\": \"WhatsUpGold\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed WhatsUp Gold instance, they can potentially gather sensitive network information, manipulate monitoring configurations, disrupt network operations, and launch further attacks on the organization&#39;s infrastructure, ultimately compromising the network&#39;s security and performance.\\n\\nIn order to remain secure it is recommended to perform the following:\\n1. Update the software to the latest version.\\n2. Replace default credentials with strong, unique ones.\\n3. Restrict remote management access.\\n4. Implement IP-based access control.\\n5. Configure secure communication protocols.\\n6. Regularly review logs for suspicious activity.\\n\\nMore information regarding configuration of the product can be found in the https://docs.ipswitch.com/en/whatsup-gold.html.\"\n    },\n    {\n        \"issueTypeId\": \"WildcardCertificate\",\n        \"remediationGuidance\": \"The use of wildcard certificates carry significant security risks.  It is recommended that each distinct service on a network has their own unique certificate.\\n\\nAdditional guidance: https://www.bleepingcomputer.com/news/security/nsa-warns-of-wildcard-certificate-risks-provides-mitigations/#:~:text&#61;MItigating%20wildcard%20certificate,their%20latest%20version.\"\n    },\n    {\n        \"issueTypeId\": \"WinRM\",\n        \"remediationGuidance\": \"If an attacker gains access to an exposed WinRM service, they can potentially execute arbitrary commands on the target system, access sensitive information, manipulate system configurations, and move laterally within the network. This can lead to unauthorized access, data breaches, and loss of control over the affected machines, severely compromising the security of the environment.\\n\\nIn order to remain secure, it is recommended to perform the following:\\n1. Disabling WinRM when not required is a crucial step in preventing unauthorized access.\\n2. Configuring firewall rules to limit inbound access to the WinRM service only from trusted IP addresses or subnets can help reduce the attack surface.\\n3. Implementing strong authentication methods, such as Kerberos or certificate-based authentication, ensures only authorized users can access WinRM. It is important to avoid using Basic or NTLM authentication, as they are less secure.\\n4. Enabling encryption for data transmitted between the client and server by enforcing HTTPS instead of HTTP for WinRM communication is essential. This can be achieved by configuring the WinRM listener to use an SSL certificate.\\n5. Regularly auditing and monitoring WinRM logs and settings to detect unauthorized access attempts, configuration changes, or other suspicious activities is necessary. It is also important to implement monitoring tools to proactively identify and respond to security threats.\"\n    },\n    {\n        \"issueTypeId\": \"WordPressAdminPage\",\n        \"remediationGuidance\": \"WordPress is a frequently targeted content management system. While there are multiple mitigations that organizations can take, the following should be done at a minimum:\\n\\n1. Use a web application firewall to block external access to the WordPress Admin page.\\n2. Password protect the WordPress Admin directory.\\n3. Enable two factor authentication in WordPress.\\n4. Limit the number of login attempts.\\n5. Enforce IP allow-listing to specific IPs.\\n6. Limit dashboard access to certain users.\\n7. In general, keep WordPress updated.\\n\\nhttps://wordpress.org/support/article/hardening-wordpress/\"\n    },\n    {\n        \"issueTypeId\": \"WordpressServer\",\n        \"remediationGuidance\": \"Exploitation of a Wordpress website can have a multitude of impacts ranging from information disclosure to remote code execution.\\n1. The type of remediation required to secure a Wordpress website may differ based on the use case, plugins, and configuration.\\n2. Vendor recommendations can be found on the https://wordpress.com/support/security/.\\n3. In general, ensure that you are running the latest software updates and are tracking Wordpress security advisories. Wordpress security releases can be found on the https://wordpress.org/news/category/security/.\"\n    },\n    {\n        \"issueTypeId\": \"WordPressSocialWarfarePlugin\",\n        \"remediationGuidance\": \"Social Warfare is a web plugin and is expected to be publicly visible on the internet. Xpanse recommends always running the latest version of this plugin to safeguard against remote code execution attacks.\"\n    },\n    {\n        \"issueTypeId\": \"XiaomiRouter\",\n        \"remediationGuidance\": \"Certain models and versions of Xiaomi routers are susceptible to security vulnerabilities, such as CVE-2018-13023 (a system command injection vulnerability).\\n\\nIf this device is vulnerable, upgrade to a secure patch. Evaluate whether or not this device should be exposed to the public internet. If is determined that this device should not be exposed to the public internet, identify the asset owner and work with them to remove the device from being publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"XmppServer\",\n        \"remediationGuidance\": \"XMPP servers should not be accessible on the public internet. If an attacker gains access to an XMPP server, they could view the company structure, perform service discovery, and read messages with confidential information. If an XMPP server must be accessible on the public internet, ensure that:\\n\\n 1. The server is running with a server certificate.\\n 2. The server is configured to not allow any cleartext client-to-server or server-to-server communications.\\n 3. The server supports XEP-0198 and XEP-0124 protocol extensions.\\n 4. Action is taken to prevent denial of service attacks, such as limiting the amount of connections from a single client.\"\n    },\n    {\n        \"issueTypeId\": \"XWiki\",\n        \"remediationGuidance\": \"If you have identified a vulnerable and exposed instance of XWiki, the following steps can help you remediate the issue:\\n\\n1. Disconnect the device from the network to prevent any further unauthorized access or compromise.\\n2. Analyze the device and review any available logs to determine if any level of compromise took place. If a compromise has taken place, take the appropriate steps to contain, eradicate, and remediate the device.\\n3. Make sure you have the latest version of XWiki installed, as newer versions often include security patches that address known vulnerabilities.\\n4. Disable any unused features in XWiki to reduce the attack surface.\\n5. Review the access controls for your XWiki instance and ensure that only authorized users have access to sensitive data.\\n6. Ensure you have proper security controls in place such as firewalls, intrusion detection systems, and antivirus software.\\n7. Regularly monitor your XWiki instance for any suspicious activity, such as unauthorized access attempts or unusual data transfers.\"\n    },\n    {\n        \"issueTypeId\": \"YealinkNetworkingDevice\",\n        \"remediationGuidance\": \"To secure Yealink Networking devices, it is recommended to perform the following:\\n\\n1. Isolate Yealink Networking devices from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Yealink Networking devices should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Yealink Networking devices are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Yealink Networking devices. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ZabbixITMonitoringSystem\",\n        \"remediationGuidance\": \"To secure Zabbix instances, it is recommended to perform the following:\\n\\n1. Isolate Zabbix instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Zabbix instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Zabbix instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Zabbix instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ZKWebFramework\",\n        \"remediationGuidance\": \"The following actions are recommended to keep your ZK built webpage secure:\\n\\n1. Ensure that all user inputs are validated on both the client and server sides to prevent any malicious code or SQL injections.\\n2. Implement a secure authentication mechanism to verify the identity of the user before providing access to sensitive information or features\\n3. Use HTTPS to encrypt all data communication between the server and client to prevent eavesdropping and man-in-the-middle attacks.\\n4. Avoid storing sensitive information such as passwords or personal details on the client-side. Instead, store them on the server-side and use secure mechanisms to retrieve and transfer the data as needed.\\n5. Keep the ZK framework and any third-party libraries up to date with the latest security patches to protect against known vulnerabilities.\\n6. Follow secure coding practices such as avoiding hard-coded passwords or credentials, limiting the use of global variables, and using parameterized SQL queries to prevent SQL injections.\"\n    },\n    {\n        \"issueTypeId\": \"ZohoManageEngineAccessManagerPlus\",\n        \"remediationGuidance\": \"Zoho ManageEngine Access Manager Plus when unpatched and misconfigured poses a serious security risk to any organization as severe vulnerabilities have been recently released including remote code execution (RCE).\\n\\n1. The Zoho ManageEngine Access Manager Plus application should be behind security controls such as a WAF. In addition Xpanse recommends enabling access filtering such as IP allow-listing, essentially implementing ZeroTrust access.\\n\\n2. Ensure monitoring is configured to detect nefarious activities such as data exfiltration, and exploit attempts.\\n\\n3. Zoho ManageEngine Access Manager Plus best practices can be followed at https://manageengine.optrics.com/access-manager-plus.aspx\"\n    },\n    {\n        \"issueTypeId\": \"ZohoManageEngineAD360\",\n        \"remediationGuidance\": \"Zoho ManageEngine AD360 is known to be vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2022-47966 and https://nvd.nist.gov/vuln/detail/CVE-2020-24786 attacks, which could put your organization at risk of being breached or experiencing a significant service interruption.\\n\\nDue to the sensitivity of the data managed by Zoho ManageEngine AD360, Xpanse recommends that all instances of Zoho ManageEngine AD360 should be placed behind a firewall or VPN and should receive timely patch updates.\"\n    },\n    {\n        \"issueTypeId\": \"ZohoManageEngineADSelfServicePlus\",\n        \"remediationGuidance\": \"1. Best practice is to not have Zoho ManageEngine ADSelfService Plus directly accessible from the internet. \\n2. Evaluate if Zoho ManageEngine ADSelfService Plus needs to be exposed to the public internet for business purposes.\\n3. If Zoho ManageEngine ADSelfService Plus does need to be accessible from the internet follow the Admin guide from ManageEngine to ensure it is secured properly. \\n4. If it does not need to be accessible from the internet follow recommendations from ManageEngine. \\n5. ManageEngine Guidance can be found here. https://www.manageengine.com/products/self-service-password/self-service-password-help-docs.html?topMenu\"\n    },\n    {\n        \"issueTypeId\": \"ZoHoManageEngineDesktopCentral\",\n        \"remediationGuidance\": \"To secure Zoho ManageEngine Desktop Central instances, it is recommended to perform the following:\\n\\n1. Isolate Zoho ManageEngine Desktop Central instances from the public internet by placing them behind a VPN.\\n2. If there is a strong business case for public accessibility, all Zoho ManageEngine Desktop Central instances should be reachable only through a firewall. Only necessary ports should be open, and running services or third-party integrations should be audited regularly.\\n3. Implement strong authentication and authorization mechanisms, such as multi-factor authentication (MFA) and role-based access control, to ensure only authorized users have access. All access control policies should follow the principle of least privilege.\\n4. Ensure that Zoho ManageEngine Desktop Central instances are up-to-date with the latest security patches and version upgrades to protect against known vulnerabilities.\\n5. Enable encryption for data transmission (e.g., HTTPS) and storage (encryption-at-rest) to protect sensitive data from unauthorized access and tampering.\\n6. Employ monitoring and intrusion detection tools to identify and respond to suspicious activities or potential security breaches on Zoho ManageEngine Desktop Central instances. Regularly review access logs and server configurations to ensure security best practices are followed.\"\n    },\n    {\n        \"issueTypeId\": \"ZohoManageEngineOpManager\",\n        \"remediationGuidance\": \"Determine whether this asset should be exposed to the public internet or not.\\nAfterwards, work with the asset owner to remove the asset should it be determined that the asset should not be publicly accessible.\"\n    },\n    {\n        \"issueTypeId\": \"ZohoManageEnginePAM360\",\n        \"remediationGuidance\": \"Zoho ManageEngine PAM360 should not be accessible on the public internet. Critical vulnerability CVE-2021-44525 affects builds before 5500 and allows for users to bypass authentication. In addition to removing public access, ensure that PAM360 is upgraded to the latest secure version.\"\n    },\n    {\n        \"issueTypeId\": \"ZohoManageEnginePasswordManagerPro\",\n        \"remediationGuidance\": \"Due to the sensitive nature of the data that can be stored within this asset, it is recommended to not have this device be publicly accessible.\\nIf it is found that the flagged asset is mistakenly exposed to the public internet, work to identify the asset owner and restrict the device from being publicly accessible.\\nIf the device needs to be internet facing for a business purpose, it is recommended to put it behind a security device such as a Web Application Firewall (WAF).\"\n    },\n    {\n        \"issueTypeId\": \"ZyxelFirewall\",\n        \"remediationGuidance\": \"Firewalls are expected to be internet-facing. However, these devices are still vulnerable and could be compromised through improper configuration, outdated or unpatched versions, and insufficient traffic monitoring. An improperly designed firewall configuration could lead to DDoS attacks, malicious intrusion via unmonitored or unnecessary ports or services, or leak of enough internal information for an attacker to stage a more impactful attack.\\n\\nXpanse recommends performing the following steps to keep firewall devices secure:\\n\\n1. Ensure the firewall\u2019s administration panel is not publicly exposed to the internet.\\n2. Routinely update the firewall to run the latest version. Actively monitor the availability of new security patches and apply them as soon as possible.\\n3. Audit open ports and running services and ensure that anything active is critical for the firewall to function and run safely.\\n4. Monitor firewall traffic to identify suspicious activity or unauthorized access attempts.\"\n    }\n]",
    "id": "RemediationGuidance",
    "itemVersion": "",
    "locked": false,
    "name": "RemediationGuidance",
    "nameLocked": false,
    "packID": "",
    "previousAllRead": true,
    "system": false,
    "truncated": false,
    "type": "plain_text",
    "version": -1,
    "fromVersion": "6.5.0"
}

RemediationGuidance

Details

Contents

Source