Chapter 25 — Laboratory I | Bachelor's Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Policy"]
  N2["Lab — update triage"]
  N3["25.2 Reading the result"]
  N4["25.3 Causes"]
  N5["25.4 Actions"]
  N6["Setting the policy"]
  N7["Exploitation likelihood"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Policy"]
  N2["Lab — update triage"]
  N3["25.2 Reading the result"]
  N4["25.3 Causes"]
  N5["25.4 Actions"]
  N6["Setting the policy"]
  N7["Exploitation likelihood"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Policy]
    |
    v
[Lab — update triage]
    |
    v
[25.2 Reading the result]
    |
    v
[25.3 Causes]
    |
    v
[25.4 Actions]
    |
    v
[Setting the policy]
    |
    v
[Exploitation likelihood]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) triage missing updates by severity and age; (2) identify overdue items; (3) plan remediation.

25.1 Policy

Critical updates within 14 days; important within 30.

The two windows give Gareth a simple rule for each missing update in the management server's report. A critical update older than 14 days is overdue, and so is an important update older than 30 days. Moderate updates have no deadline here and are installed in the normal monthly cycle. Aisha's triage lab applies exactly these two conditions to every missing update in its list. Server updates are judged against the monthly server window instead, as Dr Grant's question about servers led Aisha to note.

Lab — update triage

"""Triage synthetic missing updates by severity and age (stdlib only)."""
missing = [("BHA-L03", "critical", 41), ("BHA-L11", "important", 12), ("BHA-L19", "critical", 88), ("BHA-S02", "critical", 33),
           ("BHA-L25", "moderate", 60), ("BHA-L33", "important", 47), ("BHA-S03", "important", 5), ("BHA-L40", "critical", 9)]
rank = {"critical": 0, "important": 1, "moderate": 2}
for d, s, age in sorted(missing, key=lambda m: (rank[m[1]], -m[2])):
    flag = "OVERDUE" if (s == "critical" and age > 14) or (s == "important" and age > 30) else ""
    print(f"{d:8} {s:9} {age:3d} days {flag}")
print(f"overdue {sum(1 for d,s,a in missing if (s=='critical' and a>14) or (s=='important' and a>30))}/{len(missing)}")

Run with python3 lab_triage.py. Verified output:

BHA-L19  critical   88 days OVERDUE
BHA-L03  critical   41 days OVERDUE
BHA-S02  critical   33 days OVERDUE
BHA-L40  critical    9 days 
BHA-L33  important  47 days OVERDUE
BHA-L11  important  12 days 
BHA-S03  important   5 days 
BHA-L25  moderate   60 days 
overdue 4/8

25.2 Reading the result

Four of eight missing updates are overdue: critical on L19 (88 days), L03 (41) and S02 (33), and important on L33 (47).

The ranking shows why age alone is not enough: L25's moderate update is 60 days old but not overdue, while S02's critical update at 33 days is. L40's critical update is the newest at nine days and is still within policy. The four overdue items become Gareth's first list for the shared board. As a share, four of eight missing updates are overdue, but Aisha reports the count and names, because eight items are too few for a percentage to help.

25.3 Causes

L19 and L33 were not reporting (chapter 22); L03 has a full disk; S02 waits for a maintenance window.

Each cause points to a different fix and a different owner. The two non-reporting laptops connect the triage list back to the inventory comparison, because broken agents hide missing updates as well as other settings. L03's full disk is a local problem, and S02's delay is a planned wait for the finance server's monthly window. Aisha checks EPSS scores for the three overdue critical updates to decide which to fix first if they cannot all be fixed in one day.

25.4 Actions

Agents fixed, disk cleaned, finance server window booked.

Gareth repairs the agents on L19 and L33 so they report again, and the overdue updates install once they do. L03's full disk is cleaned up, and the critical update is then retried and confirmed installed. The finance server's critical update is booked into the next monthly window after month-end, and the delay is recorded with its reason and new date and reviewed weekly. The triage lab is rerun after each fix, and within two weeks the shared board shows no overdue items.

Setting the policy

The 14-day and 30-day windows come from discussion between Gareth and Bramley's manager, informed by NIST SP 800-40 Rev. 4's emphasis on balancing speed and disruption. Critical updates fix flaws that could be exploited easily, so they need quicker action. Aisha writes the policy in one paragraph and the manager approves it.

The triage lab turns the policy into a daily list. Aisha explains that the list is only as accurate as the management server's data, linking back to the inventory work: devices not reporting cannot show missing updates.

She also checks severity labels against vendor descriptions to make sure they are applied consistently.

Exploitation likelihood

For overdue critical updates, Aisha checks whether the vulnerability is listed as likely to be exploited, using EPSS scores described by Jacobs et al. (2021), to decide which to fix first when several are overdue.

Project log entry

Gareth keeps the triage list visible on a shared board in the IT room. Each overdue item shows its device, update, days overdue and next action. Seeing four of eight overdue at the first run is uncomfortable, but within two weeks the board is clear and stays mostly clear afterwards.

Review with the tutor

Dr Grant asks whether the 14-day window suits servers as well as laptops. Aisha keeps it, but notes that server updates wait for the monthly window, so servers are checked against that window instead.

Worked example

Gareth asks why L40's critical update is not overdue. Aisha shows it is 9 days old, within the 14-day policy.

Synthetic case. Synthetic.

Errors and limits

Severity alone ignores age; age alone ignores severity.

Exercises

EX073 — Lab overdue. Which updates were overdue?
Show marking criteria
Rubric: 3 = L19, L03, S02 critical; L33 important; 2 = three; 1 = two; 0 = none.
EX074 — Causes. Why were L19 and L33 overdue?
Show marking criteria
Rubric: 3 = not reporting; 2 = partial; 1 = vague; 0 = none.
EX075 — L40. Why was L40 not overdue?
Show marking criteria
Rubric: 3 = 9 days, within 14; 2 = partial; 1 = vague; 0 = none.

Synthesis

Combine severity and age to find overdue updates.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →