Remediation

Controlled remediation. Automatic rollback. Full audit trail.

Atomic transaction-safe remediation for security teams that cannot accept uncontrolled change execution.

The problem with most remediation tools

Most audit platforms identify what is wrong and stop there. When they do offer remediation, it is script execution without safety nets, no backup, no rollback, and no confirmation that the change worked. A failed fix applied to a production server at 2am is a worse outcome than the original finding.

How atomic remediation works

1. START TRANSACTION
   Create rollback point with configurable timeout (default: 5 min)

2. BACKUP
   Original files backed up with SHA256 checksums in manifest.json

3. APPLY
   Configuration changes applied. Services restarted if required.

4. VALIDATE
   Success -> COMMIT (backups retained for manual rollback)
   Failure -> AUTO-ROLLBACK (original files restored automatically)
    

Dead man's switch

Every remediation transaction has a timeout. If post-execution confirmation is not received within the configured window, the transaction automatically rolls back. Weekend emergencies from bad patches are prevented by design, not by process.

Access controls

Operator workflow

  1. Verify host connectivity (SSH or WinRM test built into platform)
  2. Unlock remediation with secondary auth token
  3. Select fix from eligible fix catalogue
  4. Run dry-run preview and review expected changes
  5. Execute against selected host or canary group
  6. Review execution history
  7. Apply rollback if outcome is not compliant

Finding prioritisation & remediation strategy

Not all findings should be remediated immediately. AuditToolkit provides multiple prioritisation lenses to guide remediation workflows:

Severity-driven

Critical findings auto-prioritised; lower severity batched for regular maintenance windows. Prevents alert fatigue and focuses ops effort on actual risk.

Control-family driven

Group findings by control family (Authentication, Encryption, Access Control, Logging). Remediate entire control families in themed maintenance windows.

Host-centric

Fix all findings for a single host in one remediation session, reducing operational touch-points and improving auditability of changes per asset.

Canary-driven

Apply remediation to a small canary group first, validate compliance improvement, then roll out to the entire estate for safer large-scale fixes.

Scheduled maintenance

Schedule remediation for specific maintenance windows. Automatic tickets created in ITSM system (ServiceNow, Jira) with pre-filled change details.

Risk velocity

Prioritise findings that show rapid spread across multiple hosts or control families, indicating emerging configuration drift or compliance regression.

Ownership & approval workflows

Remediation happens in controlled workflows with clear ownership and audit trail:

Ticket-driven remediation

  • Findings automatically create tickets in ServiceNow or Jira with remediation guidance pre-populated
  • Ticket assigned to owning team with SLA based on finding severity
  • Ticket state transitions mapped to remediation status (Open → In Progress → Resolved)
  • Remediation execution logged against ticket; evidence package linked for compliance proof

Approval chain

  • Secondary auth token required for critical/high severity fixes (configurable threshold)
  • Email approval workflows for fixes involving multiple hosts or cross-team coordination
  • Admin role can require dry-run review before execution on production systems
  • Every decision (approve/reject/defer) logged with operator identity and timestamp

Automation & CI/CD integration

Move remediation from manual execution to scheduled automation while maintaining safety and auditability:

Scheduled remediation

Schedule recurring remediation for specific fix categories (e.g., "Run permission hardening every Sunday at 2am"). Automatic rollback on failure; results emailed to ops team.

GitHub Actions integration

Configuration audit findings can block pipeline merges. Integrate with GitHub Actions to run remediation workflows in lower environments before production deployment.

Post-audit automation

Automatically trigger remediation for specific fix categories immediately after audit runs. Configurable delay and manual override available for caution scenarios.

Webhook-driven

External systems can trigger remediation via webhook when specific conditions are met (e.g., "Run this fix when CVE CVSS is above 8.0").

Runbook orchestration

Chain multiple fix scripts into runbooks. One control can trigger sequential changes across multiple systems with validation between steps.

Compliance gates

CI/CD pipelines can require evidence of remediation before allowing code deployment (e.g., "SSL certificates renewed" before app push).

API surface

What this toolkit has that most alternatives do not

Feature This toolkit OpenVAS Nessus Qualys
Atomic rollback Yes No No No
Auto-backup before change Yes No No Limited
Transaction timeout Yes No No No
Self-hosted deployment Yes Yes No No
Air-gap capable Yes Limited No No
Script-level audit trail Yes No No No