◇ OpenCyber Academy
Technologist · Chapter 28 · English

Chapter 28 — Field practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Field practice

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 The advisory"]
  N2["28.2 Response"]
  N3["28.3 Prioritising"]
  N4["28.4 Communication"]
  N5["28.5 Record"]
  N6["28.6 Comparison"]
  N7["Using severity and EPSS"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 The advisory"]
  N2["28.2 Response"]
  N3["28.3 Prioritising"]
  N4["28.4 Communication"]
  N5["28.5 Record"]
  N6["28.6 Comparison"]
  N7["Using severity and EPSS"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 The advisory]
    |
    v
[28.2 Response]
    |
    v
[28.3 Prioritising]
    |
    v
[28.4 Communication]
    |
    v
[28.5 Record]
    |
    v
[28.6 Comparison]
    |
    v
[Using severity and EPSS]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) respond to a real-style advisory using the new tools; (2) communicate with clients; (3) record the response.

28.1 The advisory

A synthetic advisory names a flaw in a common Python base image version. The advisory is synthetic, created by Kwame to resemble a real notice from an image maintainer, and names the affected base image version and the fixed version. Unlike the Node.js advisory at the start of the placement, it arrives after the inventory, runbooks and practice are in place. It is therefore the first realistic test of whether the handoff work changed how Cobalt responds. Kwame does not tell Priya in advance when the advisory will arrive.

28.2 Response

Priya runs the inventory and finds one internal workload using it, plus none in client clusters. The inventory search uses full image references, so it finds the one internal workload built on the named version without manual searching. The cron workload in the shared client cluster still runs python:3.6 from the public registry, but the advisory names a different version, so Priya checks its full reference and records it as not matched. She confirms the inventory result directly against the clusters before reporting it.

28.3 Prioritising

Using severity and EPSS, she rates it medium and schedules a rebuild within a week. Medium reflects both factors: the flaw's severity is high, but its EPSS score is low, and the affected workload is internal with no internet ingress. A week allows the rebuild to go through the pipeline with normal testing rather than as an urgent fix. Avoiding urgent manual changes also matters, since the drift study found that urgent fixes caused most of the drift. Priya records the rating, the reasons and the due date in the response record.

28.4 Communication

Clients receive a short note: assessed, not affected, internal fix scheduled. The note is three lines long and avoids technical terms, following the wording lessons from the team project. It tells each client that Cobalt has checked the advisory against their workloads, that none of their systems uses the affected image, and that an internal fix is scheduled. Clients receive it on the same day, before many of them have heard of the advisory. The account manager reviews the note before it is sent to the clients.

28.5 Record

The response is recorded with times, decisions and evidence. The record states when the advisory arrived, when the inventory was run, what it found, how the rating was decided with its severity and EPSS values, when clients were told and when the rebuild was scheduled. Evidence such as the saved inventory output is attached to the record. A complete record means an auditor or a later review can follow the decision without asking Priya. The record is stored in the repository beside the earlier evidence from the placement.

28.6 Comparison

The response took 25 minutes compared with six hours before. Twenty-five minutes is consistent with the half-hour measured during evaluation, which suggests that the earlier figure was not a one-off. The comparison is not perfectly fair, since this advisory affected only one workload and the original search covered every client by hand, so Priya presents it as an indication rather than as proof. The original six hours had also included discovering where the image records lived. That discovery step no longer exists, because the inventory already holds every full image reference.

Using severity and EPSS

Severity describes how bad a flaw could be; EPSS, described by Jacobs et al. (2021), estimates how likely exploitation is soon. A flaw with high severity but low EPSS score in an internal, non-internet-facing workload can wait a week; the same flaw in an internet-facing booking system would be fixed faster. Priya records both values and her reasoning.

She checks the internal workload's exposure: it has no internet ingress and runs as non-root under Restricted, which supports the medium rating.

Follow-up

After the rebuild, she re-runs the inventory to confirm the old image is gone and closes the record.

Lessons recorded

The record notes that the inventory answered the question quickly and that EPSS lookup should be added to the runbook.

Why it was fast

The speed came from the inventory, runbook and practice, not from heroic effort.

Client trust

Two clients reply thanking Cobalt for the quick, clear note, and one asks to receive such notes routinely. The account manager adds advisory notes to the service description.

Worked example

One client asks if they are safe. Priya replies with the note and offers the inventory extract for their workloads.

Synthetic case. Advisory is synthetic.

Errors and limits

"Not affected" is only as good as the inventory's completeness.

Exercises

Synthesis

Good preparation makes advisories routine.

Continue studying — chapter 28 of 30

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →