Write remediation at the cause, sequenced and affordable
Task
Take a set of findings from your own lab engagement and write remediation that fixes the cause rather than the instance, sequenced by what to do first, and priced by disruption — because a recommendation a client cannot afford is one they will not act on, and remediation is scored on whether anything moves.
Steps
- Take three or four findings from your own lab work into
/tmp/remediation.md. - For each, write remediation at the cause, not the instance — parameterised queries across the codebase, not an escape on one field; unique per-machine passwords, not a reset of the one you cracked.
- Sequence them: what to do this week versus this quarter, and why that order.
- Note cost and disruption for each, and where a compensating control is the right interim step because the real fix is not immediately available.
- Write a re-test criterion for each: what you would check to confirm it is actually fixed.
- Confirm each recommendation is something the client could realistically do.
Verify
grep -cE "^finding:" /tmp/remediation.md
grep -cE "^(cause|sequence|retest):" /tmp/remediation.md
grep -ciE "this week|this quarter|compensating|interim|disruption" /tmp/remediation.md
The first count must be non-zero: you wrote remediation for several findings. The second must be non-zero: each carries the cause-level fix, a sequence, and a re-test criterion. The third must be non-zero: you sequenced by urgency and noted cost, disruption or a compensating control — which is what makes a recommendation one a client acts on rather than files.
Notes
Fix the cause, not the instance you found — the instance is one symptom of a pattern. Sequence by what matters first, and price by disruption, because a recommendation a client cannot afford is one they will not act on. A compensating control is the right answer when the real fix is not yet available, and a re-test criterion agreed in writing is what closes the loop. All findings came from your own lab work.
This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.