Vulnerability › Module 9 › Lesson 2
Owners and Dates
Assign owner, due date, and status — remediation tracker for YOUR lab findings.
Visual · t18_owners_dates
Open finding without owner and date stays open forever. Original Cyberlium.
Opening
A remediation row with no owner is a wish — a due date makes it work.
Remediation tracker columns: Finding ID, Title, Priority, Decision (Patch/Compensate/Accept), Owner (lab role: you-as-admin), Due Date, Status (Open/In Progress/Closed), Notes. Assign owners and realistic due dates for P1/P2 from YOUR VA report — lab scenario uses your name or 'lab-admin.' SLAs literacy: P1 7 days, P2 30 days adjustable for coursework. Never assign remediation tasks on assets outside $LAB_ASSETS inventory or commit to dates on employer systems without ticket system authority.
1. Tracker fields
Link each row to report finding ID and triage evidence row.
Owner = accountable role, not vague 'IT.'
Command guide
Try these commands — Tracker fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Compensating controls — https://www.cisa.gov/topics/cybersecurity-best-practices NVD mitigations — https://nvd.nist.gov
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS 'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228' | jq '.vulnerabilities[0].cve.id' grep treatment "$HOME/cyberlium-lab/t18-remediation.txt" 2>/dev/null || echo 'Document patch vs compensate in remediation.txt'
Primary tools to practice this lesson: grep, jq. Reference sites: Compensating controls (https://www.cisa.gov/topics/cybersecurity-best-practices); NVD mitigations (https://nvd.nist.gov). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Due dates
P1 lab default: 7 calendar days from report date. P2: 30 days. Accept: review date mandatory.
Status updates weekly in lab — habit for real SOC/ticket hygiene.
3. Scope
Tracker covers $LAB_ASSETS findings from YOUR report only.
No creating tickets on stranger org Jira from unauthorized scan.
4. What you ship: remediation tracker
Tracker with ≥5 rows, owners, due dates, status — chmod 600.
5. What you record before the next lesson
Remediation tracker path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Set due dates for vulns on neighbor NAS you never had permission to scan.
Right
Assign owners and dates. Next: retest.
Mission: remediation tracker
1) Create tracker columns. 2) Fill ≥5 rows from VA report. 3) Write $LAB_ASSETS-only scope.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “SLA vs coursework deadline?”
Knowledge Check
APPLY: Remediation tracker needs:
Multiple choice
Knowledge Check
APPLY: True or False: Open finding without owner is OK.
True or False
Knowledge Check
APPLY: Accept decision requires:
Multiple choice