Take a backlog from ranked to closed, with evidence

applied · 90 min · Objective 2.3

Task

Run a complete remediation cycle on your lab: prioritise with context, agree SLAs, remediate three different ways, verify each on evidence, defer one with a proper record, and report the result honestly. Objective 2.3 is prioritising and responding, end to end.

Steps

  1. Start from the verified backlog produced by the analysis lab, not from raw scanner output.
  2. Prioritise with context: exposure from the external scan, asset purpose from the inventory, exploit availability. Produce a ranked list with the reason each item sits where it does.
  3. Set SLAs by severity and exposure, and define the clock start as the discovery date -- then check whether your data even records that date.
  4. Remediate the top three, one by patch, one by configuration, one by decommissioning something nobody needs.
  5. Verify each with the same method that found it, and record the evidence. Include one deliberate re-verification failure -- a patch without a reboot -- and show how your process catches it.
  6. Defer one item with the full record, and test the compensating control you claim.
  7. Report: what was closed, what was deferred, what is overdue, and what the verification evidence was for each closure. Then compute the number of closures that would have passed on assertion alone.

Verify

awk -F, '$6=="closed"' /tmp/backlog.csv | wc -l
awk -F, '$6=="closed" && $7=="" ' /tmp/backlog.csv | wc -l
awk -F, '$6=="deferred"' /tmp/backlog.csv | wc -l
awk -F, '$6=="deferred" && $8=="" ' /tmp/backlog.csv | wc -l

The second number must be zero: a closed finding with an empty evidence column is a ticket that was marked done. The fourth must also be zero: a deferral with no expiry date is a permanent undocumented risk, and it is how an estate accumulates exceptions nobody can account for.

Notes

The remediation rate to report is closures with evidence, divided by findings. Tickets closed divided by tickets raised is a different number that measures a different thing, and the gap between them is the size of the problem.

Keep the decommissioning. It is the only remediation guaranteed to be permanent and it is consistently the least used.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.