A simulated, end-to-end GRC engagement reflecting a real-world Security Assessment.
This project documents the full lifecycle of a Vulnerability Risk Assessment—from scope definition and technical scanning to executive reporting, compliance gap analysis, and remediation tracking. It was conducted using Nessus Essentials against a deliberately vulnerable target (Metasploitable2) in a strictly isolated VirtualBox lab environment.
| Area | Details |
|---|---|
| Risk Methodology | CVSS v3.0 + EPSS + Qualitative Business Impact (P1–P4 Priority). |
| Findings | 69 total vulnerabilities discovered: 6 Critical, 3 High, 4 Medium, 53 Informational. |
| Regulatory Mapping | Aligned to ISO 27001 (Annex A), NIST CSF, and MITRE ATT&CK. |
| Key Deliverables | Executive Summary, Risk Register, Compliance Gap Analysis, Remediation Tracker, Residual Risk Assessment, and Lessons Learned. |
| Tools Used | Nessus Essentials, Nmap, Kali Linux, VirtualBox. |
This repository is structured to mirror a professional GRC consultant's audit file.
Hiring managers: Click any document below to see exactly how I translate raw technical findings into formal business risk.
| No. | Document | Core Purpose |
|---|---|---|
| 01 | docs/01-Executive-Summary.md |
Non-technical overview for senior stakeholders (Board/CISO). |
| 02 | docs/02-Executive-Dashboard.md |
Visual KPIs: High-level risk posture and compliance heatmap. |
| 03 | docs/03-Scope-Methodology.md |
Formal Terms of Reference (ToR) defining the engagement rules and constraints. |
| 04 | docs/04-Assumed-Business-Context.md |
The "story" behind the asset: Fictional organizational profile, risk appetite, and industry scenario. |
| 05 | docs/05-Risk-Register.md |
Detailed master risk register: CVSS, EPSS, Likelihood, Impact, and P1–P4 priority scoring. |
| 06 | docs/06-Remediation-Tracker.md |
Project management artifact tracking SLA dates, remediation costs, and financial cost-benefit analysis. |
| 07 | docs/07-Compliance-Gap-Analysis.md |
Direct mapping of technical vulnerabilities to ISO 27001 Annex A and NIST CSF controls. |
| 08 | docs/08-Asset-Business-Criticality.md |
Deep dive on data sensitivity (PII/HR data) and operational criticality of the target asset. |
| 09 | docs/09-MITRE-ATTACK-Mapping.md |
Threat-informed defense mapping: Correlating vulnerabilities to real-world adversary TTPs (Tactics, Techniques, Procedures). |
| 10 | docs/10-Residual-Risk-Assessment.md |
Executive sign-off document: Formal acceptance of risk remaining after implementing compensating controls. |
| 11 | docs/11-Lessons-Learned.md |
Continual Improvement (ISO 27001 Clause 10.2): Post-engagement review identifying gaps and takeaways for future cycles. |
| Location | Description |
|---|---|
artifacts/nmap_prescan.txt |
Raw Nmap pre-assessment service/port scan output (22 open ports discovered). |
artifacts/nessus_knowledge_base.txt |
Raw Nessus Knowledge Base dump (used for manual audit trail verification). |
screenshots/ |
25 annotated screenshots showing the full VirtualBox setup, Nessus installation, plugin compilation, and live scan execution. |
Below is the complete screenshot inventory documenting the entire assessment lifecycle — from VirtualBox network configuration and Nessus installation, to vulnerability discovery and critical finding validation.
| No. | Filename | Description |
|---|---|---|
| 01 | GRC1-01-virtualbox-host-only-network-dhcp-enabled.png |
VirtualBox Host-Only network configuration with DHCP enabled (192.168.56.1/24). |
| 02 | GRC1-02-kali-network-adapter1-hostonly.png |
Kali Linux — Adapter 1 (Host-Only) configuration. |
| 03 | GRC1-03-kali-network-adapter2-nat.png |
Kali Linux — Adapter 2 (NAT) for internet access. |
| 04 | GRC1-04-metasploitable2-network-adapter-hostonly.png |
Metasploitable2 — Host-Only adapter only (internet isolated). |
| 05 | GRC1-05-metasploitable2-ifconfig-ip-assigned.png |
Metasploitable2 IP: 192.168.56.105 confirmed via ifconfig. |
| 06 | GRC1-06-kali-ip-address-both-adapters.png |
Kali IPs: 192.168.56.101 (eth0) and 10.0.3.15 (eth1/NAT). |
| 07 | GRC1-07-kali-ping-metasploitable2-success.png |
Ping test — 0% packet loss, connectivity verified. |
| 08 | GRC1-08-nessus-service-running.png |
Nessus service active — systemctl status nessusd. |
| 09 | GRC1-09-nessus-web-ui-first-launch.png |
Nessus Web UI — first launch at https://localhost:8834. |
| 10 | GRC1-10-nessus-activation-code-entered.png |
Nessus Essentials activation code registration. |
| 11 | GRC1-11-nessus-admin-account-created.png |
Nessus admin account creation confirmation. |
| 12 | GRC1-12-nessus-plugin-download-progress.png |
Plugin download in progress — ~180,000 NASL plugins. |
| 13 | GRC1-12-nessus-plugin-download-complete-dashboard.png |
Plugin compilation complete — dashboard ready. |
| 14 | GRC1-12.01-nessus-plugin-download-complete-dashboard.png |
Dashboard (alternate view) — plugins compiled. |
| 15 | GRC1-13-nessus-scan-template-selection.png |
Scan template: Basic Network Scan selected. |
| 16 | GRC1-14-nessus-scan-configuration.png |
Scan config — target 192.168.56.105, CVSS v3.0. |
| 17 | GRC1-15-nessus-scan-launched-running.png |
Scan launched — live progress feed. |
| 18 | GRC1-15-nessus-scan-running-live-results.png |
Scan running — live vulnerability results. |
| 19 | GRC1-16-nessus-scan-completed-history.png |
Scan completed — 18 minutes total. |
| 20 | GRC1-16-nmap-prescan-metasploitable2-services.png |
Nmap pre-scan — 22 open ports discovered. |
| 21 | GRC1-17-nessus-vulnerabilities-full-list.png |
Nessus findings — top vulnerabilities view. |
| 22 | GRC1-18-nessus-vulnerabilities-complete-list-scrolled.jpg |
Full list — all 69 vulnerabilities. |
| 23 | GRC1-19-nessus-finding-bind-shell-backdoor-detail.png |
Critical (P1): Bind Shell Backdoor (port 1524) — CVSS 9.8, root access confirmed. |
| 24 | GRC1-20-nessus-finding-vnc-password-detail.png |
Critical (P1): VNC Default Password (password) — CVSS 10.0. |
| 25 | GRC1-21-nessus-finding-ssl-v2-v3-detection.png |
Critical (P1): SSL v2/v3 Enabled — CVSS 9.8, PCI DSS non-compliant. |
| 26 | GRC1-22-nessus-finding-debian-openssl-rng-weakness.png |
Critical (P1): CVE-2008-0166 — CVSS 10.0, cryptographic keys compromised. |
| 27 | GRC1-23-exports-not-available-nessus-essentials.png |
Nessus Essentials — export limitation (no PDF/CSV/HTML). |
Visual Audit Trail: These 25 screenshots serve as the primary evidence artifact for this assessment. Together with the raw Nmap and Nessus Knowledge Base outputs, they provide a complete, defensible audit trail for ISO 27001 and NIST CSF compliance reviews.
- Risk Assessment Lifecycle: Conducted a formal risk assessment including scoping, data gathering, vulnerability analysis, and business impact analysis.
- Compliance Frameworks: Mapped identified technical risks to specific ISO 27001 Annex A controls and NIST CSF functions to show audit-readiness.
- Risk Quantification: Utilized CVSS v3.0 and EPSS to quantify exploitability, combined with business context to assign P1–P4 priorities.
- Threat-Informed Defense: Mapped findings to the MITRE ATT&CK framework, demonstrating an understanding of adversary TTPs (initial access, credential access, and exfiltration).
- Executive Communication & Justification: Translated complex technical vulnerabilities (e.g., CVE-2008-0166 OpenSSL RNG) into business risk; provided a Cost-Benefit Analysis in the remediation tracker to justify security spend.
- Residual Risk & Governance: Formalized an executive sign-off process for accepted risks, proving the ability to close out a governance cycle properly.
This assessment was conducted in an isolated VirtualBox environment (192.168.56.0/24) against the intentionally vulnerable Metasploitable2 VM. No real-world networks or devices were scanned. All activities were performed legally and ethically for educational and portfolio purposes.