Compensate for a patch you cannot apply

applied · 65 min · Objective 4.2

Task

Apply objective 4.2: take something in your lab that genuinely cannot be patched, choose a compensating control from what the vulnerability needs, and put an expiry on it.

Steps

  1. Record the component and why it cannot be patched in lab/unpatchable.md, distinguishing 'not yet' from 'never'.
  2. Determine what exploitation REQUIRES -- network reachability, a specific feature enabled, a particular privilege -- and record it.
  3. Choose the compensating control from that list rather than from habit, and implement it. Capture the evidence that it took effect.
  4. Record it in lab/exceptions.csv with a compensating control, an owner, and an expiry TIED to the patch where one is expected, or to a review date where none is.
  5. Add a detection specific to exploitation of that vulnerability, trigger a benign approximation of it, and capture the alert.

Verify

grep -Eci 'never|end of life|vendor|not yet' lab/unpatchable.md
grep -Eci 'reachab|feature|privilege|precondition' lab/unpatchable.md
awk -F, 'NR>1 && $NF!="closed" {n++} END {print n" open exception(s)"}' lab/exceptions.csv
sh lab/expire-exceptions.sh; echo "expiry check exit=$?"

The precondition analysis present, the exception recorded with an expiry, and the expiry check from domain 1 still running over the grown register. For genuinely permanent cases, isolation is the design rather than a temporary compensation, and the record should say so.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.