Lesson 01 — Enterprise Vulnerability & Compliance Strategy

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 09 – Vulnerability & Compliance Management

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand enterprise vulnerability management.
Differentiate vulnerabilities, threats and risks.
Understand CVE and CVSS scoring.
Learn enterprise compliance frameworks.
Understand the vulnerability management lifecycle.
Prioritise remediation using risk-based approaches.
Design an enterprise vulnerability management programme.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate

Prerequisites: Module 08 – Network Protection

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies has successfully implemented:

Identity & Access Management
Network Security
Logging & Monitoring
Incident Response

The organisation now supports:

40 AWS Accounts
800 Amazon EC2 Instances
250 Amazon ECR Repositories
Hundreds of Lambda Functions
Thousands of Amazon S3 Buckets
Multiple Kubernetes Clusters

Although the environment appears secure, the monthly security assessment reveals several critical findings.

Examples include:

EC2 servers running outdated software
Containers containing Critical CVEs
IAM roles with excessive permissions
Public Amazon S3 buckets
Missing operating system patches
Unsupported software versions
Misconfigured security groups
Resources that violate company policies

The CISO asks:

“How do we continuously identify security weaknesses before attackers exploit them?”

As the Cloud Security Engineer, your responsibility is to establish a vulnerability and compliance programme that continuously identifies, prioritises and tracks security risks across the organisation.

Why Vulnerability Management Matters

Security is not a one-time activity.

New vulnerabilities are discovered every day.

Applications change.

Servers are patched.

Developers deploy new code.

Cloud resources are created and deleted continuously.

Without continuous assessment, today’s secure environment can become tomorrow’s security incident.

Enterprise Security Lifecycle

CloudNova follows a continuous improvement model.

Identify

↓

Assess

↓

Prioritise

↓

Remediate

↓

Validate

↓

Monitor

↓

Repeat

This lifecycle ensures vulnerabilities are managed before they become incidents.

What is a Vulnerability?

A vulnerability is a weakness that could be exploited by an attacker.

Examples include:

Outdated software
Missing security patches
Weak encryption
Public S3 buckets
Open management ports
Misconfigured IAM policies
Default passwords
Unsupported operating systems

A vulnerability does not always result in a breach, but it increases organisational risk.

Threat vs Vulnerability vs Risk

These terms are often confused.

Term	Meaning
Threat	Something capable of causing harm
Vulnerability	A weakness that can be exploited
Risk	The likelihood and impact of exploitation

Example:

Threat

↓

Cyber Criminal

↓

Exploits

↓

Unpatched Server

↓

Results In

↓

Data Breach

Real Enterprise Example

Consider the following EC2 instance.

Operating System

Ubuntu 20.04

↓

Apache Version

2.4.29

↓

Known Critical CVE

↓

Public Web Server

The server functions correctly.

However, attackers know this software version contains publicly documented vulnerabilities.

Unless updated, the server remains at risk.

What is a CVE?

CVE stands for:

Common Vulnerabilities and Exposures

Every publicly disclosed vulnerability receives a unique identifier.

Example:

CVE-2025-12345

This identifier allows security teams worldwide to reference the same vulnerability consistently.

CVE Structure

Example:

CVE-2025-12345

│

├── Year Published

└── Unique Identifier

Security advisories, vendors and vulnerability scanners all reference CVE identifiers.

What is CVSS?

CVSS stands for:

Common Vulnerability Scoring System

It measures the severity of a vulnerability.

CVSS Severity Ratings

Score	Severity
0.0	None
0.1–3.9	Low
4.0–6.9	Medium
7.0–8.9	High
9.0–10.0	Critical

Higher scores indicate greater urgency.

Enterprise Risk Prioritisation

CloudNova does not fix vulnerabilities randomly.

Instead, vulnerabilities are prioritised using risk.

Example:

Vulnerability	Asset	Priority
Critical CVE on Internet-facing EC2	Production	Immediate
High CVE on Development Server	Development	Medium
Medium CVE on Test Server	Test	Low

Business impact influences remediation priority.

Risk-Based Vulnerability Management

CloudNova considers several factors.

CVSS Score

+

Business Impact

+

Internet Exposure

+

Data Sensitivity

+

Exploit Availability

=

Risk Priority

This helps security teams focus on vulnerabilities that pose the greatest risk.

Vulnerability Management Lifecycle

Enterprise vulnerability management follows six stages.

Asset Discovery

↓

Vulnerability Discovery

↓

Risk Assessment

↓

Remediation

↓

Validation

↓

Reporting

This lifecycle is continuous and should be integrated into daily operations.

Compliance vs Security

Security and compliance are related but not identical.

Security protects systems.

Compliance demonstrates that required controls are in place.

Examples of compliance frameworks include:

ISO 27001
PCI DSS
CIS Benchmarks
NIST Cybersecurity Framework
SOC 2
HIPAA
GDPR

Compliance helps organisations satisfy regulatory and contractual requirements.

Shared Responsibility

AWS secures:

Data Centres
Physical Infrastructure
Networking Hardware
Hypervisor

Customers secure:

Operating Systems
Applications
IAM
Patching
Configuration
Encryption
Compliance

Understanding these responsibilities is critical for maintaining a secure environment.

Enterprise Vulnerability Management Programme

CloudNova follows a structured programme.

Asset Inventory

↓

Continuous Scanning

↓

Risk Assessment

↓

Prioritisation

↓

Patch Management

↓

Verification

↓

Executive Reporting

This process enables consistent governance across all AWS accounts.

Roles & Responsibilities

Team	Responsibility
Cloud Security Engineer	Identify vulnerabilities and recommend remediation
SOC Team	Monitor security findings
Infrastructure Team	Apply operating system patches
DevOps Team	Update applications and container images
Compliance Team	Validate regulatory requirements
CISO	Review enterprise security posture

Security is a shared organisational responsibility.

Enterprise Dashboard

CloudNova’s executive dashboard tracks:

Total Vulnerabilities
Critical Vulnerabilities
Patch Compliance
Open Findings
Compliance Score
Mean Time to Remediate (MTTR)
High-Risk Assets
Trend Over Time

Executives use these metrics to understand organisational risk.

Enterprise Best Practices

CloudNova standards include:

Maintain an accurate asset inventory.
Continuously scan workloads.
Prioritise vulnerabilities based on risk.
Apply security patches promptly.
Validate remediation after changes.
Monitor compliance continuously.
Produce regular executive reports.
Integrate vulnerability management into DevSecOps pipelines.

🛠 Lab 01 — Identify Enterprise Assets

Create an inventory of the following AWS resources.

Amazon EC2
Amazon EBS
Amazon S3
IAM Roles
Lambda Functions
Amazon RDS
Amazon ECR
VPCs

Classify each resource according to:

Business Criticality
Internet Exposure
Data Sensitivity

🛠 Lab 02 — Risk Classification

Review the following findings.

Finding	Priority
Critical CVE on Production EC2	______
Public S3 Bucket	______
Unused IAM Administrator Role	______
Medium Vulnerability on Development Server	______
Unsupported Operating System	______

Explain your reasoning for each priority.

🛠 Lab 03 — Build a Vulnerability Lifecycle

Create a flowchart illustrating:

Asset Discovery

↓

Scanning

↓

Risk Assessment

↓

Remediation

↓

Verification

↓

Reporting

Explain who is responsible for each stage.

🛠 Lab 04 — Compliance Review

Select one compliance framework.

Examples:

CIS AWS Foundations Benchmark
PCI DSS
ISO 27001
NIST Cybersecurity Framework

Research:

Objectives
Key Security Controls
AWS Services that support compliance

Document your findings.

💻 AWS CLI Lab

List EC2 Instances

aws ec2 describe-instances

List Amazon S3 Buckets

aws s3 ls

List IAM Roles

aws iam list-roles

List Amazon ECR Repositories

aws ecr describe-repositories

List Lambda Functions

aws lambda list-functions

✅ Verification

Verify that you can:

✔ Explain vulnerabilities, threats and risks.

✔ Describe CVE and CVSS.

✔ Explain risk-based prioritisation.

✔ Describe the vulnerability management lifecycle.

✔ Differentiate compliance from security.

✔ Explain enterprise vulnerability management.

🔍 Troubleshooting

Problem

Too many vulnerabilities to fix.

Prioritise using:

CVSS Score
Business Impact
Internet Exposure
Data Sensitivity

Problem

Assets are missing from reports.

Verify:

Asset inventory
AWS Accounts
AWS Regions
Resource discovery processes

Problem

Compliance findings continue to increase.

Review:

Configuration management
Patch management
Security baselines
Change management processes

🚫 Common Mistakes

❌ Treating all vulnerabilities as equally important.

❌ Focusing only on CVSS scores without considering business impact.

❌ Ignoring development environments.

❌ Maintaining incomplete asset inventories.

❌ Applying patches without testing.

❌ Performing one-time security assessments instead of continuous monitoring.

🧪 DIY Challenge

CloudNova has acquired another company and inherited hundreds of unknown AWS resources.

Design a vulnerability and compliance management strategy that:

Creates a complete asset inventory.
Continuously scans workloads.
Prioritises vulnerabilities based on business risk.
Tracks remediation progress.
Produces executive dashboards.
Demonstrates compliance with industry standards.

Prepare:

Vulnerability Management Workflow
Risk Prioritisation Matrix
Executive Dashboard Design
Compliance Reporting Process

📊 Knowledge Check

What is a vulnerability?
What is the difference between a threat, vulnerability and risk?
What does CVE stand for?
What is the purpose of CVSS?
Why should vulnerabilities be prioritised based on business risk?
What are the stages of the vulnerability management lifecycle?
What is the difference between security and compliance?
Which responsibilities belong to AWS and which belong to the customer?
Why is continuous monitoring essential?
Which enterprise metrics help measure the effectiveness of a vulnerability management programme?

💡 Key Takeaways

After completing this lesson, you should understand:

Vulnerability management is a continuous process of discovering, assessing, prioritising and remediating security weaknesses.
Risk should be determined by combining technical severity with business impact rather than relying solely on CVSS scores.
Compliance frameworks provide structured security baselines that help organisations meet regulatory and industry requirements.
A successful enterprise programme depends on accurate asset inventories, continuous scanning, effective remediation and executive reporting.
This strategic foundation prepares you to use AWS-native services such as Amazon Inspector, Patch Manager, IAM Access Analyzer and Amazon Macie in the following lessons.

🚀 Next Lesson

➡️ Lesson 02 — Amazon Inspector & Patch Management