PB-017: Vulnerability Response

Document Control

1. Purpose & Scope

• Purpose:

  Provide a structured response for critical or high-risk vulnerabilities where remediation, containment, and validation are required. Use this playbook to validate the vulnerability, identify exposed assets, reduce risk, coordinate patching or configuration changes, and confirm remediation.

• Scope:

  Applies to confirmed vulnerabilities affecting organisational applications, infrastructure, endpoints, cloud services, network services, SaaS platforms, appliances, third-party software, or managed services. If exploitation is confirmed, invoke PB-015.

2. Incident Identification & Criteria

Incident Type: Vulnerability Response

Trigger Conditions:

Initiate this playbook when any of the following occur:

• Critical or high-risk vulnerability affects organisational assets
• Vendor advisory, CVE, scanner finding, penetration test, researcher report, or threat intelligence identifies urgent remediation need
• Vulnerability has known exploitation risk, public exploit code, internet exposure, or sensitive-system impact
• Zero-day response transitions to remediation after a patch or durable fix becomes available

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Sets severity, coordinates response, approves containment tradeoffs, and owns escalation decisions.
• Vulnerability Management Lead: Confirms vulnerability details, affected versions, exposure, remediation options, and remediation tracking.
• Technical Lead: Coordinates containment, patching, configuration changes, testing, and validation.
• Communications Lead: Coordinates stakeholder, executive, vendor, customer, and legal communications.
• Other Roles:
  • System / Application Owners: Patch, configure, test, and validate affected services.
  • Cloud / Network / Platform Teams: Apply infrastructure controls, segmentation, access restrictions, and provider mitigations.
  • Legal / Compliance: Reviews customer, contractual, regulatory, and disclosure obligations.

4. Initial Actions

• Immediate Steps:

  • Validate the vulnerability, affected product/version, severity, exploitability, and source of the report.
    • 📘 RB-TRIAGE-009: Vulnerability Validation
  • Identify whether any exploitation is already suspected or confirmed.
    • 📘 RB-ANALYSIS-041: Exploitation Verification
  • Identify the asset owner, business owner, remediation owner, and required response timeline.
  • Engage vulnerability management, system/application owners, platform teams, and IR leadership.
    • 📘 SOP-001: Paging an Engineering Team's On-Call

  Decision Point:

  • If exploitation is confirmed → execute PB-015: Active Exploitation immediately.
  • If no patch or durable fix exists → execute PB-018: Zero-Day Response.
  • If a patch, upgrade, configuration fix, or durable mitigation exists → continue this playbook.

5. Investigation & Analysis

Common Failure Modes:

• Treating vulnerability response as complete before validation
• Missing shadow assets, cloud assets, third-party managed systems, or unsupported versions
• Failing to verify exploitation status
• Removing compensating controls before durable remediation is confirmed
• Leaving exceptions without owners or due dates

• Evidence Collection:

  • Collect vulnerability scan results, vendor advisories, affected versions, asset inventory, exposure data, compensating controls, and remediation status.
  • Preserve relevant security telemetry if exploitation is suspected during response.

• Analysis Steps:

  • Assess exposure requirements, affected attack paths, accessibility, business criticality, and potential impact.
    • 📘 RB-ANALYSIS-039: Vulnerability Exposure Assessment
  • Identify all vulnerable assets, owners, versions, environments, and remediation groups.
    • 📘 RB-ANALYSIS-040: Vulnerable Asset Identification
  • Assess exploitation likelihood, public exploit availability, active campaigns, and vendor/threat intelligence.
    • 📘 RB-ANALYSIS-042: Vulnerability Threat Intelligence Assessment
  • Verify whether exploitation has occurred before remediation begins or while remediation is in progress.
    • 📘 RB-ANALYSIS-041: Exploitation Verification

  Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:

  • If exploitation is confirmed → execute PB-015: Active Exploitation concurrently.
  • If malware or suspicious execution is identified → execute PB-003: Endpoint Malware Infection or PB-011: Suspicious Execution concurrently.
  • If account compromise or credential abuse is identified → execute PB-004: Account Takeover concurrently.
  • If data exposure, staging, or exfiltration is identified → execute PB-005: Data Exfiltration concurrently.
  • If cloud compromise is identified → execute PB-007: Cloud Compromise concurrently.
  • If web application compromise is identified → execute PB-008: Web Application Attack concurrently.
  • If no patch is available → execute PB-018: Zero-Day Response concurrently.

6. Containment, Eradication & Recovery

• Containment Actions:

  • Reduce exposure using network restrictions, access controls, WAF rules, feature disablement, configuration changes, segmentation, or service isolation.
    • 📘 RB-CONTAIN-014: Vulnerability Exposure Reduction
  • Apply exploit-path containment where the vulnerability is actively targeted or high-risk.
    • 📘 RB-CONTAIN-012: Exploitation Surface Containment

• Eradication Steps:

  • Patch, upgrade, reconfigure, disable, replace, or remove vulnerable components according to approved remediation plan.
  • Rotate exposed secrets or credentials if the vulnerability could disclose sensitive material.
  • Remove temporary workarounds only after permanent remediation is validated.

• Recovery Steps:

  • Validate patch deployment, configuration changes, vulnerability scan results, exposure reduction, and service functionality.
    • 📘 RB-RECOVERY-007: Vulnerability Remediation Validation
  • Confirm residual risk, accepted exceptions, and outstanding remediation items are tracked to closure.

7. Communication & Escalation

• Internal Communication:

  • Notify security leadership, vulnerability management, system/application owners, platform owners, and impacted business stakeholders.
  • Use geo handoff where remediation spans response shifts.
    • 📘 SOP-002: Incident Handoff Between Geos

• External Communication:

  • Coordinate vendor, customer, regulator, executive, and legal communications through approved processes.
    • 📘 SOP-003: Escalation, Legal & Executive Communications
    • 📘 SOP-005: Vendor Communication During a Security Incident

• Escalation Criteria:

  Condition	Escalate To
  Exploitation confirmed	PB-015: Active Exploitation
  No patch or durable fix available	PB-018: Zero-Day Response
  Malware or suspicious execution identified	PB-003: Endpoint Malware Infection / PB-011: Suspicious Execution
  Account compromise or credential abuse identified	PB-004: Account Takeover
  Data exposure, staging, or exfiltration identified	PB-005: Data Exfiltration
  Cloud compromise identified	PB-007: Cloud Compromise
  Web application compromise identified	PB-008: Web Application Attack
  Widespread risk or major business impact	PB-019: Major Security Incident Management

8. Post-Incident Activities

• Lessons Learned:

  • Conduct a PIR covering detection source, exposure, asset inventory quality, remediation speed, exception handling, and validation quality.
  • Review vulnerability management, patch SLAs, compensating controls, scanner coverage, and ownership gaps.

• Documentation Updates:

  • Update vulnerability records, asset inventory, remediation tracking, detections, runbooks, and this playbook based on lessons learned.

9. References & Linked Resources

• Playbooks:

  • PB-003: Endpoint Malware Infection
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-008: Web Application Attack
  • PB-011: Suspicious Execution
  • PB-015: Active Exploitation
  • PB-018: Zero-Day Response
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-009: Vulnerability Validation
  • RB-ANALYSIS-039: Vulnerability Exposure Assessment
  • RB-ANALYSIS-040: Vulnerable Asset Identification
  • RB-ANALYSIS-041: Exploitation Verification
  • RB-ANALYSIS-042: Vulnerability Threat Intelligence Assessment
  • RB-CONTAIN-012: Exploitation Surface Containment
  • RB-CONTAIN-014: Vulnerability Exposure Reduction
  • RB-RECOVERY-007: Vulnerability Remediation Validation

• SOPs:

  • SOP-001: Paging an Engineering Team's On-Call
  • SOP-002: Incident Handoff Between Geos
  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-005: Vendor Communication During a Security Incident

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.