owasp-infrastructure

Use the vulnerability index to select relevant ISR categories, then apply each document's vulnerability checklist to your environment. Each reference provides prevention controls, detection guidance, and remediation steps for gaps you identify.

It covers ten risks: outdated software, insufficient threat detection, insecure configurations, insecure resource and user management, insecure cryptography, insecure network access management, weak authentication and default credentials, information leakage, insecure access to management components, and insufficient asset management.

This framework targets internal IT infrastructure such as networks, servers, Active Directory, and management components rather than web application code. It focuses on risks like flat networks, unpatched systems, and default device credentials.

Yes, the checklists and category groupings map well to audit activities like access reviews, patch management verification, and asset inventory reconciliation. However, it is a knowledge base, not an automated scanning or certification tool.

No, it contains only reference documents with guidance, checklists, and remediation steps. Actual scanning requires external tools such as vulnerability scanners or SIEM platforms, which the references recommend deploying.