Patch, Compensate, or Accept

A public advisory almost always points at a fixed version, a vendor KB, or a library bump. Patch treatment is: name the package, name the target version, name the owner who will install it on systems they administer, name a window, and name the check (version string after upgrade, vendor health page, not “PoC failed”). On a laptop you own, that owner is you. In a company, it is a named role — platform, app, desktop — not “the intern with Kali.” You do not patch other people’s computers. You do not “help” a café by upgrading their gateway. You do not scan the internet looking for unpatched copies of Heartbleed to practice the verb.

Patch is usually the preferred treatment when a fix exists and the service still matters. It is also the treatment students skip because exploiting felt more like class. This course inverts that: the literacy is reading the bump. If you ran OpenSSL on a TLS service you own and the advisory says “upgrade to 1.0.1g or later” (Heartbleed-era wording as history), your note is the upgrade sentence, not a memory-disclosure toy. If you do not run the product, the patch line is “n/a — not in inventory,” which is a valid close, not a failed lab. Closing with “n/a” is analysis. Closing with searchsploit is not.

cat >> "$NOTES" << 'EOF'
treatment: PATCH
who_installs: (me, on MY lab VM — fill a name)
target_version: (from the advisory, in MY words)
window: (when)
EOF

Compensating controls are temporary or long-lived substitutes when a patch is late, a vendor is slow, or a change window is blocked. Examples you may write for a system YOU own: bind the daemon to loopback (you already did this for teaching HTTP); disable the vulnerable feature the advisory named; put the service behind an allow-list; require a stronger front door (VPN or extra factor — Module 6 will talk hashes and MFA as defense, not as cracking homework); stop the unused listener entirely (Module 4 lockdown). A compensating control must be specific. “We have a firewall” is not a control. “This port is not in the WAN allow-list; only 127.0.0.1 listens” is a control.

Compensating does not mean “hide the banner and call it patched.” Lesson 2’s false-negative warning still applies. It also does not mean “run the exploit from a second VM to prove the WAF caught it” as a Cyberlium lab. You may, on infrastructure you own, confirm a feature flag is off by reading config. You may not download weaponized repositories to test the control. If the only way you can imagine verifying a control is an exploit payload, you are still in the wrong lesson. Write the control, the owner who maintains it, and the date you will revisit whether a patch has become available. Compensation without a revisit date becomes silent accept — which is the next heading, and it needs a signature.

cat >> "$NOTES" << 'EOF'
treatment: COMPENSATE
control: (bind 127.0.0.1 / disable unused module / firewall default deny — pick one you own)
not_compensate: hoping nobody finds it
EOF

Accept is a real treatment. Some findings are low impact, not reachable, or more expensive to patch this week than the leftover risk. Accepting without writing it down is how forgotten CVEs become next year’s incident. The note needs: who accepted (you, for a personal lab; a manager or risk owner in a company), why (impact vs cost, exposure already tiny, product end-of-life with a replacement date), residual risk in one sentence (what could still happen on a host you own), and a review date. “We accept until 1 March or until the vendor ships, whichever is first” is a treatment. “Whatever” is not.

You still do not accept risk on systems you do not own. You cannot accept a school’s residual Heartbleed. You cannot accept the café’s router CVE. Those owners are not you. If you have written RoE as a tester, you recommend a treatment in a report; the client’s named owner accepts or patches. Your screenshot of a tool that attacks the finding is not their acceptance. Cyberlium labs never substitute an exploit run for that signature. If this feels bureaucratic, good: vulnerability analysis is paperwork with ethics, not a montage of shells.

date -u +"%Y-%m-%dT%H:%M:%SZ"
cat >> "$NOTES" << 'EOF'
treatment: ACCEPT
residual: (what remains)
named_owner: (who accepted)
review_date: (fill)
EOF

Every treatment line is a tiny ticket: finding ID (CVE or scanner plugin), system (a host or app YOU own, or a clearly labeled hypothetical owned system), decision (patch / compensate / accept), owner, due or review date, check (how you will know it worked without a PoC). Module 4’s enum lockdown used the same columns for unused services and banners. Reuse them. A Metasploit resource script is not a check. A nuclei blast of the internet is not a check. A hashcat run is not a check (and is not this module). The check is: version changed, listener stopped, config flag off, or acceptance recorded.

Scope freeze, again, because treatment is where people “helpfully” touch the wrong computers. You may change configuration on systems you own. You may write recommendations when RoE says you may. You may not apply patches to campus, disable a neighbor’s SMB as a prank, or “compensate” the hotel network by scanning it until the rows vanish. python http.server leftover from Module 4 is treated by stopping it or binding loopback — that is compensate/patch-adjacent lockdown, still not Log4Shell. Do not write “run module/exploit/…” as the fix. Lesson 1 already banned that sentence; this lesson bans it as a fake treatment.

A finding can move: compensate this month, patch next month, then close. What fails is listing all three verbs with no owner so nobody does any of them. Pick a primary treatment for the note you will write. If you compensate, the revisit date is mandatory. If you patch, the version target is mandatory. If you accept, the residual-risk sentence is mandatory. Empty “TBD” fields fail this lesson the same way empty ethics lines failed Module 2. Famous CVEs as literacy examples (CVE-2014-0160, CVE-2021-44228) are fine to practice the verbs on a hypothetical service you imagine owning — “if I ran this library in an app I deploy.” They are not fine as a hunt list for leftover internet victims.

Legal reminder, original Cyberlium: this is teaching mapped to the CEH v13 vulnerability-analysis domain. It is not official EC-Council training, not a certification, not exam dumps, and not a license to exploit. Using the words patch, residual risk, and CVE does not grant vendor courseware. Public advisory text is public; weaponized repos stay out. Your file is risk-treatment-notes.txt, mode 600, under cyberlium-lab — the same locked tree as scanner-vs-risk-notes.txt and cve-literacy-notes.txt.

Fill the template for one finding. You may reuse a CVE you read in Lesson 1 as literacy, applied to a hypothetical app or TLS service YOU would own — not to random IPs. You may instead treat leftover local http.server as “stop the listener / bind loopback” (compensate/lockdown) if you want a strictly local row. Do not run exploits. chmod 600.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cd "$HOME/cyberlium-lab"

{

You now treat a surviving finding as a ticket: patch the vendor bump, compensate with a control you can name, or accept residual risk with a person and a review date. None of those is a payload. Notes stay locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 vulnerability-analysis domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Read a Sample CVE and Write a Fix Note — a public NVD or vendor page, impact plus treatment for a hypothetical system you own, file cve-fix-note.txt. Still no exploit clone. Still no searchsploit. Still no scanning random IPs.