Respond to a disclosure against your own estate

applied · 90 min · Objective 2.4

Task

Simulate the morning of a major dependency disclosure and run the whole sequence under a clock: establish the facts, determine exposure, narrow by reachability, mitigate, hunt retrospectively, remediate, and report. Objective 2.4 is the governance and risk context, and this is where it becomes operational.

Steps

  1. Pick a package present in your SBOM and write the advisory yourself: affected versions, the precondition for exploitation, whether a fix exists. Then put it aside and work from the advisory, not from your knowledge.
  2. Start a timer. Establish the facts: exactly which versions are affected, and what has to be true for it to matter.
  3. Determine exposure across everything -- host packages, container images, the application's lock file, anything vendored. Answer where, with a list.
  4. Narrow by reachability and configuration: is the vulnerable function called, is the feature enabled, is the component build-time only?
  5. Mitigate immediately where you cannot fix: remove reachability, disable the feature, add a rule.
  6. Hunt retrospectively. Assume exploitation may already have happened and search your logs for the indicators the advisory implies. This is the step that is skipped, and it is where a real incident would be found.
  7. Remediate, verify, and write the report: what you found, what you did, what you could not determine, and how long each phase took.

Verify

jq -r '.components[] | select(.name=="the-affected-package") | .version' /tmp/sbom.json
grep -rl "the-affected-package" ./vendor/ 2>/dev/null | wc -l
trivy image --quiet myapp:new | grep -c "the-affected-package"
grep -icE "the-affected-endpoint|the-affected-parameter" /var/log/apache2/access.log

The first three are exposure from three surfaces -- packaged, vendored, and container -- and a response that checks only the first is the common failure. The fourth is the retrospective hunt, and its result belongs in the report whether it is zero or not, with the retention window stated beside it.

Notes

Record your elapsed times per phase. The organisations that answer within hours are the ones that already had an inventory and an SBOM, not the ones that worked harder on the day, and your own timings are the argument for building both.

The hunt matters as much as the patch. Patching closes the door and says nothing about whether somebody already came through it -- which is the same distinction this course has drawn in every domain.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.