Runbook 02 — Enterprise Vulnerability & Compliance Assessment

Module: 09 – Vulnerability & Compliance Management

Enterprise Lab: 02

Estimated Time: 4–5 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: Free Tier (No additional AWS charges)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, you have been assigned to perform a comprehensive vulnerability and compliance assessment of the AWS environment.

Your goal is to evaluate the organization’s security posture, identify vulnerabilities, assess compliance against industry standards, prioritise remediation activities, and present an executive report to senior management.

By completing this runbook, you will learn how to:

Review Amazon Inspector findings
Assess EC2 vulnerability exposure
Review AWS Systems Manager Patch Compliance
Review AWS Config Rules
Review AWS Security Hub findings
Review AWS Audit Manager assessments
Review AWS Trusted Advisor recommendations
Review AWS Health Dashboard events
Assess CIS Benchmark compliance
Assess PCI DSS readiness
Assess ISO 27001 controls
Prioritise security findings
Develop remediation plans
Produce executive compliance reports

🏢 Business Scenario

CloudNova Technologies has recently completed a major cloud migration and is preparing for an external security audit.

Management has requested an independent assessment of the AWS environment to ensure:

Critical vulnerabilities are identified
Systems remain fully patched
Security controls comply with organisational policies
AWS resources align with CIS AWS Foundations Benchmark
PCI DSS requirements are satisfied
Security risks are prioritised before production certification

As the Cloud Security Engineer, you are responsible for performing the assessment and presenting recommendations to the Chief Information Security Officer (CISO).

📋 Prerequisites

Complete:

Enterprise Runbook 01 — Build Enterprise Vulnerability & Compliance Management

Required:

AWS Account
Administrator Access
AWS CLI Installed
Visual Studio Code

🏗 Existing Enterprise Environment

CloudNova AWS Environment

                 AWS Organization
                        │
        ┌───────────────┼────────────────┐
        │               │                │
 Amazon Inspector   Patch Manager   AWS Config
        │               │                │
        └───────────────┼────────────────┘
                        │
                AWS Security Hub
                        │
              AWS Audit Manager
                        │
              AWS Trusted Advisor
                        │
             AWS Health Dashboard
                        │
          Cloud Security Operations Team

Your objective is to determine whether CloudNova’s AWS environment is secure, compliant, and ready for external audit.

Step 1 — Review Amazon Inspector

Navigate to:

AWS Console

↓

Amazon Inspector

↓

Findings

Review:

Critical Findings
High Findings
Medium Findings
Common Vulnerabilities and Exposures (CVEs)
Network Reachability Findings
Package Vulnerabilities

Questions:

Are critical vulnerabilities present?
Which EC2 instances have the highest risk?
Are vulnerabilities actively exploitable?

AWS CLI

aws inspector2 list-findings

Step 2 — Review Patch Compliance

Navigate to:

AWS Systems Manager

↓

Compliance

Review:

Missing Security Updates
Missing Critical Patches
Patch Baselines
Maintenance Windows
Patch Groups

Questions:

Which systems are overdue for patching?
Are maintenance windows configured correctly?

AWS CLI

aws ssm list-compliance-items

Step 3 — Review AWS Config

Navigate to:

AWS Config

↓

Rules

Review:

Root MFA Enabled
CloudTrail Enabled
Security Groups Open to Internet
S3 Encryption
EBS Encryption
IAM Password Policy
Restricted SSH Access

Questions:

Which resources are non-compliant?
Which Config Rules are failing most frequently?

AWS CLI

aws configservice describe-config-rules

Step 4 — Review AWS Security Hub

Navigate to:

AWS Security Hub

Review:

Security Score
Active Findings
Failed Controls
Compliance Standards

Review standards:

AWS Foundational Security Best Practices
CIS AWS Foundations Benchmark

Questions:

Which controls have failed?
Which findings require immediate action?

AWS CLI

aws securityhub get-findings

Step 5 — Review AWS Audit Manager

Navigate to:

AWS Audit Manager

Review:

Assessments
Evidence Collection
Control Sets
Audit Reports

Verify assessments for:

PCI DSS
CIS Benchmark
ISO 27001

Questions:

Are all required controls mapped?
Is evidence collection complete?

AWS CLI

aws auditmanager list-assessments

Step 6 — Review AWS Trusted Advisor

Navigate to:

AWS Trusted Advisor

Review Security recommendations including:

IAM Security
MFA Usage
Public Access
Security Groups
Service Limits
Cost Optimisation

Questions:

Which recommendations remain unresolved?
Which findings present the highest operational risk?

Step 7 — Review AWS Health Dashboard

Navigate to:

AWS Health Dashboard

Review:

Service Events
Scheduled Maintenance
Security Notifications
Regional Service Issues

Questions:

Have AWS events affected security operations?
Are planned maintenance activities documented?

Step 8 — Review Compliance Status

Evaluate compliance against:

CIS AWS Foundations Benchmark
PCI DSS
ISO 27001
Internal Security Policies

Review:

Passed Controls
Failed Controls
High Risk Controls
Evidence Availability

Determine overall compliance posture.

Step 9 — Prioritise Security Findings

Classify findings according to business risk.

Severity	Response Target
Critical	Immediate
High	Within 24 Hours
Medium	Within 7 Days
Low	During Planned Maintenance

Create a prioritised remediation backlog.

Step 10 — Develop Remediation Plan

Immediate Actions

Patch critical EC2 vulnerabilities
Enable missing MFA
Remove public Security Group exposure
Enable encryption
Resolve failed Security Hub controls

Short-Term Improvements

Standardise Patch Baselines
Improve Config Rule coverage
Automate remediation
Improve compliance reporting

Long-Term Improvements

Multi-account governance
Continuous vulnerability scanning
Automated compliance dashboards
Centralised security reporting
Security Operations integration

Step 11 — Validation

Verify:

Amazon Inspector reviewed
Patch Compliance reviewed
AWS Config reviewed
Security Hub reviewed
Audit Manager reviewed
Trusted Advisor reviewed
AWS Health reviewed
Compliance assessed
Risks documented
Remediation roadmap completed

🧪 Enterprise Challenge

CloudNova Technologies is preparing for a PCI DSS Level 1 and ISO 27001 certification audit.

The assessment identifies:

28 Critical Amazon Inspector findings
12 EC2 instances missing security patches
4 Security Groups allowing unrestricted SSH access
3 IAM users without MFA
5 S3 buckets without default encryption
CloudTrail disabled in one development account
Security Hub reporting multiple failed CIS controls
AWS Config identifying non-compliant resources
Trusted Advisor reporting several high-risk security recommendations

Your task is to:

Assess the overall security posture
Prioritise vulnerabilities by business impact
Map findings to compliance requirements
Develop a remediation roadmap
Prepare an executive summary for the CISO
Recommend improvements for continuous compliance monitoring

📄 Deliverables

Capture screenshots of:

Amazon Inspector Findings
Patch Compliance Dashboard
AWS Config Rules
AWS Security Hub Dashboard
Audit Manager Assessment
Trusted Advisor Security Checks
AWS Health Dashboard

Submit:

Enterprise Vulnerability Assessment Report
Compliance Assessment Report
Risk Register
Remediation Roadmap
Executive Summary
Compliance Gap Analysis

🧹 Cleanup

This is primarily an assessment runbook.

Do NOT delete:

Amazon Inspector
Patch Manager
AWS Config
Security Hub
Audit Manager
Trusted Advisor Configuration
Compliance Reports

Delete only:

Temporary test resources
Test Config Rules
Experimental compliance assessments
Temporary reports created during testing

✅ Runbook Checklist

💡 Lessons Learned

What were the highest-risk vulnerabilities identified?

How do Amazon Inspector, AWS Config, Security Hub, and Audit Manager complement each other in an enterprise vulnerability management program?

Why is continuous compliance monitoring essential for modern cloud environments?

How should security teams prioritise remediation activities when multiple critical findings are discovered?

How would you enhance CloudNova Technologies’ vulnerability management process across a multi-account AWS Organization?

🚀 Next Module

10 — Backup, Disaster Recovery & Business Continuity

In the next module, you will design and implement enterprise backup and disaster recovery strategies using AWS Backup, Amazon EBS Snapshots, Amazon RDS Backups, AWS Elastic Disaster Recovery (DRS), Amazon S3 Versioning, Cross-Region Replication, and business continuity planning to ensure resilience, rapid recovery, and minimal downtime during security incidents and infrastructure failures.