Capstone -- run vulnerability management for a quarter

capstone · 180 min · Objective 2.4

Task

Operate a complete vulnerability management function over your lab for a simulated quarter and produce the artefacts it exists to produce. Unguided: the deliverables are specified, the method is yours.

Steps

  1. Cycle one: establish scope, scan, analyse, remediate the top items, verify.
  2. Change the estate between cycles the way a real one changes: add a host, rebuild a container from an updated base, decommission something, and let one credential expire.
  3. Cycle two: repeat, and produce the comparison. Classify every difference as fixed, new, or artefact.
  4. Cycle three: repeat again, so a trend exists rather than a pair of points.
  5. Assess the controls, testing each rather than reading its configuration.
  6. Write the three reports last, from the accumulated evidence.

Verify

wc -l < /tmp/active.txt
awk -F, 'NR>1{print $1}' /tmp/backlog.csv | sort -u | wc -l
awk -F, '$6=="closed" && $7!=""' /tmp/backlog.csv | wc -l
awk -F, '$6=="deferred" && $8!=""' /tmp/backlog.csv | wc -l
awk -F, '$6=="deferred" && $8==""' /tmp/backlog.csv | wc -l
for f in /tmp/report-*.md; do printf "%s %s words\n" "$f" "$(wc -w < "$f")"; done

Assets in scope, assets with findings, closures carrying evidence, deferrals carrying an expiry, and deferrals carrying none -- that last count must be zero. The report word counts are a crude but real check on audience: an executive report the same length as the engineer's has not been written for an executive.

Notes

The trend across three cycles is the capstone's real output. A single scan is a snapshot and cannot say whether anything is improving; three cycles with an annotated estate change can, and annotating the change is what stops a coverage increase from reading as a security regression.

Keep the exception register. The Domain 4 labs report from it, and the aggregate accepted position is the number that no individual record makes visible.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.