TITAN LEGACY: 12 real EOL findings -> CHG ticket opened -> compensating-control evidence attached

THE SECURITY FINDING

Windows Server 2008 R2 Datacenter detected — past end-of-life 2020-01-14 (2290 days). ESU enrollment not detected. Hosting PACS medical imaging workload (PHI). Fails HIPAA 164.308(a)(5)(ii)(B), PCI DSS 6.2, SOX ITGC-VR, NIST 800-53 SI-2.

JUSTIFICATION

Critical: Windows Server 2008 R2 Datacenter detected — past end-of-life 2020-01-14 (2290 days). ESU enrollment not detected. Hosting PACS medical imaging workload (PHI). Fails HIPAA 164.308(a)(5)(ii)(B), PCI DSS 6.2, SOX ITGC-VR, NIST 800-53 SI-2.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Enroll in Windows Server 2008 Extended Security Updates (ESU expired 2023-01-10 — escalation path only). Plan Azure VM migration to Windows Server 2022. Isolate via NSG until cutover. Compensating control pack auto-generated.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (vm-pacs-imaging-01).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Windows Server 2008 R2 Datacenter detected — past end-of-life 2020-01-14 (2290 days). ESU enrollment not detected. Hosting PACS medical imaging workload (PHI). Fails HIPAA 164.308(a)(5)(ii)(B), PCI DS

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of vm-pacs-imaging-01 before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans vm-pacs-imaging-01 immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Enroll in Windows Server 2008 Extended Security Updates (ESU expired 2023-01-10 — escalation path only). Plan Azure VM migration to Windows Server 2022. Isolate via NSG until cutover. Compensating control pack auto-generated.

AI CLOSE NOTES

TITAN CONDUIT opened this critical legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Microsoft Exchange Server 2013 CU23 detected via EWS + OWA banner — past end-of-life 2023-04-11 (380 days). No ESU path exists for Exchange 2013. Internet-exposed on port 443. Fails HIPAA 164.312(e)(1), PCI DSS 6.2, SOC 2 CC7.1, NYDFS 500 §500.07.

JUSTIFICATION

Critical: Microsoft Exchange Server 2013 CU23 detected via EWS + OWA banner — past end-of-life 2023-04-11 (380 days). No ESU path exists for Exchange 2013. Internet-exposed on port 443. Fails HIPAA 164.312(e)(1), PCI DSS 6.2, SOC 2 CC7.1, NYDFS 500 §500.07.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Migrate mailboxes to Exchange Online (M365) or Exchange Server 2019. Interim: block OWA externally, keep ActiveSync only, apply post-CU23 community patches.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (ec2-exchange-2013-prod).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Microsoft Exchange Server 2013 CU23 detected via EWS + OWA banner — past end-of-life 2023-04-11 (380 days). No ESU path exists for Exchange 2013. Internet-exposed on port 443. Fails HIPAA 164.312(e)(1

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of ec2-exchange-2013-prod before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans ec2-exchange-2013-prod immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Migrate mailboxes to Exchange Online (M365) or Exchange Server 2019. Interim: block OWA externally, keep ActiveSync only, apply post-CU23 community patches.

AI CLOSE NOTES

TITAN CONDUIT opened this critical legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

SQL Server 2012 Enterprise detected — past end-of-life 2022-07-12 (651 days). ESU eligible but not enrolled. Hosts core banking ledger with CHD + SOX-relevant financial data. Fails PCI DSS 3.4 + 6.2, SOX ITGC-CM, FFIEC CAT, SOC 2 CC8.1.

JUSTIFICATION

High: SQL Server 2012 Enterprise detected — past end-of-life 2022-07-12 (651 days). ESU eligible but not enrolled. Hosts core banking ledger with CHD + SOX-relevant financial data. Fails PCI DSS 3.4 + 6.2, SOX ITGC-CM, FFIEC CAT, SOC 2 CC8.1.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Option 1: Enroll in SQL Server 2012 ESU (available until July 2025). Option 2: Migrate to Azure SQL Managed Instance. Compensating controls: TDE, network isolation, MFA, session monitoring.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (sqlsrv-core-ledger-prod).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: SQL Server 2012 Enterprise detected — past end-of-life 2022-07-12 (651 days). ESU eligible but not enrolled. Hosts core banking ledger with CHD + SOX-relevant financial data. Fails PCI DSS 3.4 + 6.2, 

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of sqlsrv-core-ledger-prod before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans sqlsrv-core-ledger-prod immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Option 1: Enroll in SQL Server 2012 ESU (available until July 2025). Option 2: Migrate to Azure SQL Managed Instance. Compensating controls: TDE, network isolation, MFA, session monitoring.

AI CLOSE NOTES

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Oracle Database 11g Enterprise detected on RDS — past end-of-life 2020-12-31 (1222 days). ESU (Sustaining Support) requires Premier Support contract. Holds ERP data subject to SOX. Fails SOX ITGC-VR, PCI DSS 6.2, NIST 800-53 SI-2, ISO 27001 A.12.6.1.

JUSTIFICATION

High: Oracle Database 11g Enterprise detected on RDS — past end-of-life 2020-12-31 (1222 days). ESU (Sustaining Support) requires Premier Support contract. Holds ERP data subject to SOX. Fails SOX ITGC-VR, PCI DSS 6.2, NIST 800-53 SI-2, ISO 27001 A.12.6.1.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Upgrade to Oracle 19c (Extended Support through 2030) on RDS or Aurora PostgreSQL. Compensating: restrict VPC access, enable Database Activity Streams, audit every DDL.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (rds-oracle-erp-11g).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Oracle Database 11g Enterprise detected on RDS — past end-of-life 2020-12-31 (1222 days). ESU (Sustaining Support) requires Premier Support contract. Holds ERP data subject to SOX. Fails SOX ITGC-VR, 

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of rds-oracle-erp-11g before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans rds-oracle-erp-11g immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Upgrade to Oracle 19c (Extended Support through 2030) on RDS or Aurora PostgreSQL. Compensating: restrict VPC access, enable Database Activity Streams, audit every DDL.

AI CLOSE NOTES

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Container base image 'centos:7' detected in ACR — CentOS 7 EOL 2024-06-30 (297 days). Used as base for 14 downstream application images currently deployed. Fails CIS Controls v8 7.3, NIST 800-53 CM-6.

JUSTIFICATION

Medium: Container base image 'centos:7' detected in ACR — CentOS 7 EOL 2024-06-30 (297 days). Used as base for 14 downstream application images currently deployed. Fails CIS Controls v8 7.3, NIST 800-53 CM-6.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Rebuild images from rockylinux:9 or almalinux:9. Update all 14 downstream Dockerfile FROM statements. Rolling deploy via existing CI/CD.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM risk — weaker control, should be hardened.
Business impact if unremediated: Control weakness that compounds with other gaps.
Scope: single resource (acr-retired-image-base).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Container base image 'centos:7' detected in ACR — CentOS 7 EOL 2024-06-30 (297 days). Used as base for 14 downstream application images currently deployed. Fails CIS Controls v8 7.3, NIST 800-53 CM-6.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of acr-retired-image-base before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans acr-retired-image-base immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Rebuild images from rockylinux:9 or almalinux:9. Update all 14 downstream Dockerfile FROM statements. Rolling deploy via existing CI/CD.

AI CLOSE NOTES

TITAN CONDUIT opened this medium legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

IBM i (AS/400) V7R2M0 detected — past end-of-life 2021-04-30 (1097 days). Runs claims-adjudication workload with PHI. No IBM i ESU equivalent. Fails HIPAA 164.308(a)(1), PCI DSS 6.2, NIST 800-53 SI-2, HITRUST 10.g.

JUSTIFICATION

High: IBM i (AS/400) V7R2M0 detected — past end-of-life 2021-04-30 (1097 days). Runs claims-adjudication workload with PHI. No IBM i ESU equivalent. Fails HIPAA 164.308(a)(1), PCI DSS 6.2, NIST 800-53 SI-2, HITRUST 10.g.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Upgrade to IBM i 7.5 (extended support through 2031). Compensating: Precisely Assure security monitoring, network segregation to PACS/EHR only, session audit to SIEM.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (as400-claims-v7r2).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: IBM i (AS/400) V7R2M0 detected — past end-of-life 2021-04-30 (1097 days). Runs claims-adjudication workload with PHI. No IBM i ESU equivalent. Fails HIPAA 164.308(a)(1), PCI DSS 6.2, NIST 800-53 SI-2,

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of as400-claims-v7r2 before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans as400-claims-v7r2 immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Upgrade to IBM i 7.5 (extended support through 2031). Compensating: Precisely Assure security monitoring, network segregation to PACS/EHR only, session audit to SIEM.

AI CLOSE NOTES

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

SAP ECC 6.0 EHP5 non-HANA detected — mainstream maintenance ends 2027-12-31 (995 days). Runs manufacturing ERP with SOX-relevant financial postings. Migration to S/4HANA deferred. Fails SOX ITGC-CM, ISO 27001 A.12.2, NIST 800-53 CM-6 (planning failure).

JUSTIFICATION

High: SAP ECC 6.0 EHP5 non-HANA detected — mainstream maintenance ends 2027-12-31 (995 days). Runs manufacturing ERP with SOX-relevant financial postings. Migration to S/4HANA deferred. Fails SOX ITGC-CM, ISO 27001 A.12.2, NIST 800-53 CM-6 (planning failure).

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Begin S/4HANA migration assessment (SAP Readiness Check 2.0). Enroll in SAP Premium Extended Maintenance ($TBD) until cutover. Compensating: segregate from DMZ, SIEM forwarding of SM20 audit log.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (sap-ecc-prod-ehp5).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: SAP ECC 6.0 EHP5 non-HANA detected — mainstream maintenance ends 2027-12-31 (995 days). Runs manufacturing ERP with SOX-relevant financial postings. Migration to S/4HANA deferred. Fails SOX ITGC-CM, I

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of sap-ecc-prod-ehp5 before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans sap-ecc-prod-ehp5 immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Begin S/4HANA migration assessment (SAP Readiness Check 2.0). Enroll in SAP Premium Extended Maintenance ($TBD) until cutover. Compensating: segregate from DMZ, SIEM forwarding of SM20 audit log.

AI CLOSE NOTES

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

VMware ESXi 6.5 U3 detected on 8-node production cluster — past end-of-life 2022-10-15 (554 days). Hosts 142 production VMs including PCI-scope workloads. Fails PCI DSS 6.2, HIPAA 164.308(a)(5)(ii)(B), SOC 2 CC7.1.

JUSTIFICATION

Critical: VMware ESXi 6.5 U3 detected on 8-node production cluster — past end-of-life 2022-10-15 (554 days). Hosts 142 production VMs including PCI-scope workloads. Fails PCI DSS 6.2, HIPAA 164.308(a)(5)(ii)(B), SOC 2 CC7.1.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Upgrade to ESXi 8.0 U2 (supported until 2027) or migrate workloads to Azure/AWS/GCP. Interim: apply VMware's final security patches, isolate vCenter from untrusted networks.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (esxi-host-prod-cluster-05).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: VMware ESXi 6.5 U3 detected on 8-node production cluster — past end-of-life 2022-10-15 (554 days). Hosts 142 production VMs including PCI-scope workloads. Fails PCI DSS 6.2, HIPAA 164.308(a)(5)(ii)(B)

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of esxi-host-prod-cluster-05 before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans esxi-host-prod-cluster-05 immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Upgrade to ESXi 8.0 U2 (supported until 2027) or migrate workloads to Azure/AWS/GCP. Interim: apply VMware's final security patches, isolate vCenter from untrusted networks.

AI CLOSE NOTES

TITAN CONDUIT opened this critical legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Cisco ASA 9.1(7)32 firmware detected on perimeter firewall — past end-of-life 2022-08-31 (601 days). No further security patches will be issued. Exposed CVE-2024-20481 unpatchable. Fails NIST 800-53 SC-7, CIS Controls v8 Control 12, PCI DSS 1.1.

JUSTIFICATION

Medium: Cisco ASA 9.1(7)32 firmware detected on perimeter firewall — past end-of-life 2022-08-31 (601 days). No further security patches will be issued. Exposed CVE-2024-20481 unpatchable. Fails NIST 800-53 SC-7, CIS Controls v8 Control 12, PCI DSS 1.1.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Replace with Cisco Firepower 2100 series or Palo Alto PA-400 (current firmware). Interim: subscribe to Cisco PSIRT advisories, compensating IDS behind the firewall.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM risk — weaker control, should be hardened.
Business impact if unremediated: Control weakness that compounds with other gaps.
Scope: single resource (cisco-asa-fw-edge-01).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Cisco ASA 9.1(7)32 firmware detected on perimeter firewall — past end-of-life 2022-08-31 (601 days). No further security patches will be issued. Exposed CVE-2024-20481 unpatchable. Fails NIST 800-53 S

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of cisco-asa-fw-edge-01 before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans cisco-asa-fw-edge-01 immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Replace with Cisco Firepower 2100 series or Palo Alto PA-400 (current firmware). Interim: subscribe to Cisco PSIRT advisories, compensating IDS behind the firewall.

AI CLOSE NOTES

TITAN CONDUIT opened this medium legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(1)(ii)(D), PCI DSS 6.2, SOC 2 CC7.1, NIST 800-53 SI-2.

JUSTIFICATION

High: WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(1)(ii)(D), PCI DSS 6.2, SOC 2 CC7.1, NIST 800-53 SI-2.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Migrate claims gateway to IBM WebSphere Liberty 23.x on RHEL 9 or rewrite as Azure App Service. Enroll Windows 2012 R2 ESU as stop-gap ($ per core). Compensating: WAF, MFA on admin, tamper-evident logs.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (app-websphere-claims-gateway).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: WebSphere 8.0 on Windows Server 2012 R2 — both past end-of-life. WebSphere 8.0 EOL 2018-04-30, Windows 2012 R2 EOL 2023-10-10 (ESU available until 2026-10-13 but not enrolled). Fails HIPAA 164.308(a)(

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of app-websphere-claims-gateway before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans app-websphere-claims-gateway immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Migrate claims gateway to IBM WebSphere Liberty 23.x on RHEL 9 or rewrite as Azure App Service. Enroll Windows 2012 R2 ESU as stop-gap ($ per core). Compensating: WAF, MFA on admin, tamper-evident logs.

AI CLOSE NOTES

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

SQL Server 2008 R2 detected on RDS — past end-of-life AND past ESU (2022-07-12). Holds student records (FERPA). No further Microsoft or AWS patches will be issued. Fails FERPA §99.31, NIST 800-53 SI-2, ISO 27001 A.12.6.1, SOC 2 CC7.1.

JUSTIFICATION

High: SQL Server 2008 R2 detected on RDS — past end-of-life AND past ESU (2022-07-12). Holds student records (FERPA). No further Microsoft or AWS patches will be issued. Fails FERPA §99.31, NIST 800-53 SI-2, ISO 27001 A.12.6.1, SOC 2 CC7.1.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   Upgrade to SQL Server 2022 on RDS or migrate to Aurora PostgreSQL. Compensating until cutover: VPC-only access, IAM DB auth, enhanced monitoring every 1s, database activity streams to S3.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (rds-sqlserver-2008r2-pastsu).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: SQL Server 2008 R2 detected on RDS — past end-of-life AND past ESU (2022-07-12). Holds student records (FERPA). No further Microsoft or AWS patches will be issued. Fails FERPA §99.31, NIST 800-53 SI-2

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of rds-sqlserver-2008r2-pastsu before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans rds-sqlserver-2008r2-pastsu immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

Upgrade to SQL Server 2022 on RDS or migrate to Aurora PostgreSQL. Compensating until cutover: VPC-only access, IAM DB auth, enhanced monitoring every 1s, database activity streams to S3.

AI CLOSE NOTES

TITAN CONDUIT opened this high legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

RHEL 6 Server detected — past end-of-life 2020-11-30, past ELS (Extended Life-cycle Support) 2024-06-30. Runs telecom billing stack with CPNI data. Fails CPNI 47 CFR §64.2011, NIST 800-53 SI-2, ISO 27001 A.12.6.1, CIS Controls v8 7.3.

JUSTIFICATION

Medium: RHEL 6 Server detected — past end-of-life 2020-11-30, past ELS (Extended Life-cycle Support) 2024-06-30. Runs telecom billing stack with CPNI data. Fails CPNI 47 CFR §64.2011, NIST 800-53 SI-2, ISO 27001 A.12.6.1, CIS Controls v8 7.3.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   In-place upgrade to RHEL 8/9 via Leapp utility, OR lift-and-shift to Amazon Linux 2023. Compensating: no new package install, file-integrity monitoring, CloudWatch log forwarding.
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM risk — weaker control, should be hardened.
Business impact if unremediated: Control weakness that compounds with other gaps.
Scope: single resource (ec2-rhel6-billing-stack).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: RHEL 6 Server detected — past end-of-life 2020-11-30, past ELS (Extended Life-cycle Support) 2024-06-30. Runs telecom billing stack with CPNI data. Fails CPNI 47 CFR §64.2011, NIST 800-53 SI-2, ISO 27

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of ec2-rhel6-billing-stack before change (baseline: titan-legacy-demo-20260422T201927Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans ec2-rhel6-billing-stack immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

In-place upgrade to RHEL 8/9 via Leapp utility, OR lift-and-shift to Amazon Linux 2023. Compensating: no new package install, file-integrity monitoring, CloudWatch log forwarding.

AI CLOSE NOTES

TITAN CONDUIT opened this medium legacy_eol ticket and assigned it to the security_engineering group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)