Wombat

WAF-SEC-150 – Vulnerability and patch management MUST cover compute instances, operating systems, and endpoints

Pillar: Security | Severity: 🟠 High | Category: Container Security | Automatable: Medium

Description

All virtual machines, bare-metal servers, and container hosts MUST receive automated security patches within defined SLAs. Critical vulnerabilities MUST be remediated within 7 days and high vulnerabilities within 30 days. Endpoint Detection and Response (EDR) MUST be deployed on all production instances. Patch compliance and scan results MUST be centrally reported and reviewed.

Rationale

Risk Description

Risk

Unpatched operating systems and endpoints are primary entry points for malware and lateral movement.

Risk

Missing EDR delays detection of compromised instances and impedes incident response.

Requirements

  • All virtual machines, bare-metal servers, and container hosts MUST receive automated security patches within defined SLAs.

  • Critical vulnerabilities MUST be remediated within 7 days and high vulnerabilities within 30 days.

  • Endpoint Detection and Response (EDR) MUST be deployed on all production instances.

  • Patch compliance and scan results MUST be centrally reported and reviewed.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-sec-150.config.patch-policy-documented

Engine: config | Provider: any | Automated: No

OS patch policy and EDR coverage must be documented

OS patch policy and EDR coverage must be documented

Scope: file — docs/security/patch-management.md

Assertions: * exists attribute_exists — Patch management policy must exist and cover SLA and EDR.

Remediation: OS patch policy and EDR coverage must be documented

Compliant
# Example compliant with waf-sec-150.config.patch-policy-documented
Non-Compliant
# Example non-compliant with waf-sec-150.config.patch-policy-documented

waf-sec-150.tf.aws.ssm-patch-manager

Engine: terraform | Provider: aws | Automated: Yes

AWS SSM Patch Manager must be configured for managed instances

AWS SSM Patch Manager must be configured for managed instances

Scope: resource — aws_ssm_patch_baseline, aws_ssm_association

Assertions: * name attribute_exists — Patch baseline must be defined.

Remediation: AWS SSM Patch Manager must be configured for managed instances

Compliant
# Example compliant with waf-sec-150.tf.aws.ssm-patch-manager
Non-Compliant
# Example non-compliant with waf-sec-150.tf.aws.ssm-patch-manager

waf-sec-150.tf.azurerm.mde-deployed

Engine: terraform | Provider: azurerm | Automated: Yes

Azure VMs must have Microsoft Defender for Endpoint extension deployed

Azure VMs must have Microsoft Defender for Endpoint extension deployed

Scope: resource — azurerm_virtual_machine_extension

Assertions: * type in ['MicrosoftMonitoringAgent', 'MDE.Windows', 'MDE.Linux'] — VM must have Defender for Endpoint or monitoring extension.

Remediation: Azure VMs must have Microsoft Defender for Endpoint extension deployed

Compliant
# Example compliant with waf-sec-150.tf.azurerm.mde-deployed
Non-Compliant
# Example non-compliant with waf-sec-150.tf.azurerm.mde-deployed

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls

  • WAF-SEC-070

  • WAF-SEC-120

  • WAF-SEC-130

  • WAF-SEC-010

  • WAF-SEC-100

  • WAF-OPS-030

  • WAF-SOV-120 == Regulatory Mapping

  • ISO 27001:2022: A.8.7 – Protection against malware, A.8.8 – Management of technical vulnerabilities

  • CIS Controls v8: CIS 7 – Continuous Vulnerability Management

  • PCI DSS v4.0: Req 6 – Develop and maintain secure systems and software

  • SOC 2 Type II: CC7.1 – Vulnerability detection

  • GDPR: Art. 32 – Security of processing

  • NIS2: Art. 21(2)(g) – Vulnerability handling and disclosure

  • DORA: Art. 9 – Protection and prevention

  • BSI C5:2020: INF-07 – Vulnerability management

  • NIST SP 800-53: RA-5 – Vulnerability Scanning, SI-2 – Flaw Remediation

  • NIST CSF 2.0: RS.MA-01 – Vulnerability management