I have completed a Nessus vulnerability scan of a Windows system. The scan is indicating that some windows patches are missing, but the patches are superseded patches and the most recent version of the patch is installed. I researched the two patches and the older patch is superseded by a cumulative patch and the old one is not available. The Nessus report has offered a registry fix that does remove it from the scan.
I can see two scenarios here (and possibility missing more):
- Windows is releases fixes to patches that are not fully fixing problems
- Nessus is enumerating the patch list and is reporting the patch as an audit concern and not a security concern.
I am wondering should I be proceeding with the fixes for system hardening or can I take the easier route (in my case) and document that the finding is not a security concern.