🛡️ Essential 8 Guide

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.

Summary

ISM-1702 requires a vulnerability scanner to run at least fortnightly to identify missing patches for operating systems on workstations, non-internet-facing servers, and non-internet-facing network devices. Onboard devices to Defender for Endpoint and use Microsoft Defender Vulnerability Management to continuously monitor and identify vulnerabilities across the environment for remediation.¹

Justification

Fortnightly scanning ensures that:

• Newly disclosed OS CVEs are detected before the one-month patch deadline, providing sufficient lead time for testing and deployment.
• Newly enrolled or re-imaged devices running older OS images are discovered immediately; devices entering maintenance or returning from storage may miss patches applied to actively managed devices.
• OS-layer vulnerabilities are the highest-impact attack surface for internal lateral movement. Once an attacker establishes a foothold, unpatched internal OS vulnerabilities (privilege escalation, remote code execution on internal nodes) are the primary path to domain compromise and ransomware deployment.

Microsoft Defender Vulnerability Management provides continuous, automated scanning with database updates daily from the Microsoft Threat Intelligence feed, exceeding the fortnightly minimum requirement.

Design Decision

[!NOTE] The vulnerability scanning implementation will onboard devices to Microsoft Defender for Endpoint. The Microsoft Defender security portal report under Exposure management > Vulnerabilities will be used to monitor and manage identified vulnerabilities.

Prerequisites

• Dependencies:
  • Devices must be onboarded to Microsoft Defender for Endpoint. ¹
  • Microsoft Defender Vulnerability Management should be available for continuous risk monitoring, which requires devices to be onboarded to Defender for Endpoint. ¹
  • If Defender for Cloud vulnerability scanning is used, enable vulnerability assessment for machines in Defender for Cloud and configure Defender Vulnerability Management. ²

Implementation Steps

Onboard devices to Microsoft Defender for Endpoint and review vulnerabilities in Defender portal

1. Create a new Windows Configuration Profile with a type of template for Microsoft Defender for Endpoint (desktop devices running Windows 10 or later).³
2. Set Expedite telemetry reporting frequency to Enable.³
3. Assign the profile to a group containing all applicable Windows devices.³
4. Confirm devices are onboarded to Microsoft Defender for Endpoint and that Microsoft Defender Vulnerability Management will continuously monitor risk across devices.³
5. Open the Microsoft Security Portal and navigate to Vulnerability Management > Inventories to view software products identified across endpoints onboarded to Defender for Endpoint, including vendor name, weaknesses found, threats, and exposed devices.³
6. (Optional) Initiate remediation using the Defender and Intune workflow:
   • Enable the Microsoft Intune connection in the Defender portal: Settings > Endpoints > General > Advanced features > turn on the Microsoft Intune connection.³
   • In Defender portal, go to Vulnerability Management > Recommendations; select a security recommendation and choose Remediation options; fill out the form with what you are requesting remediation for, applicable device groups, priority, due date, and optional notes.³
   • Submit remediation to create a remediation activity item in Defender for Vulnerability Management and a remediation ticket in Intune; remediation actions will be tracked but will not automatically apply changes to devices.³

Note: Onboarded devices and vulnerability data are accessed through the Defender security portal as part of exposure management and ongoing risk monitoring.³

Additional related information

• Microsoft Defender Vulnerability Management provides integrated vulnerability assessment, asset visibility, and remediation workflows within the Defender portal Microsoft Defender Vulnerability Management

• Defender for Cloud’s integrated vulnerability assessment offers VM, container and SQL vulnerability scanning to identify weaknesses across resources Defender for Cloud vulnerability assessment

• EPSS prioritization helps focus remediation by probability of exploit within vulnerability management workflows EPSS

• Microsoft Security Exposure Management helps identify attack paths and prioritizes remediation based on asset criticality Microsoft Security Exposure Management