Patch it, and find out you did not

short · 50 min · Objective 2.3

Task

Remediate three findings three different ways, then verify each properly -- and produce, deliberately, the two most common false "fixed" results so you can recognise them.

Steps

  1. Pick three findings from your credentialed scan: one fixable by patching, one by configuration change, and one you will mitigate without fixing.
  2. Patch the first. Do not reboot. Re-scan, and record what the scan says.
  3. Now reboot and re-scan again. Compare. The gap between those two results is the patched-but-not-rebooted trap, and it appears in real scan comparisons constantly.
  4. Configure the second away: disable the module, close the port, remove the feature. Re-scan and verify by testing the behaviour directly rather than trusting the plugin.
  5. Mitigate the third with a firewall rule that blocks reachability, leaving the vulnerability in place. Verify the rule works. Then write the ticket for the real fix and the expiry date for the rule, because a virtual patch without both becomes permanent.
  6. Produce the second false fix on purpose: re-scan with the credential removed and confirm all three findings "disappear".

Verify

dpkg -l | awk '$2=="the-patched-package"{print $3}'
ss -tln | grep -c ":8080"
sudo iptables -L INPUT -n | grep -c "10.10.10.20"
grep -c "the-patched-package" /tmp/rescan-cred.csv
grep -c "the-patched-package" /tmp/rescan-nocred.csv

The installed version proves the patch landed. The socket and firewall counts prove the configuration change and the mitigation. The last two are the lesson: the finding is absent from both files, but only one of those absences is remediation -- the other is a scan that could not authenticate, which produces an identically clean line in a report.

Notes

Close findings on evidence and record what the evidence was. A remediation rate computed from tickets closed measures ticket hygiene; one computed from verified rescans, using the same method that found the issue, measures security.

Keep the expiry date on the firewall rule where someone will see it. Temporary controls that outlive their tickets are how an estate accumulates mitigations nobody can explain.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.