Patch Compensate Accept
Remediation options on YOUR lab findings — patch first, compensate when needed, accept with ticket.
Visual · t18_patch_compensate_accept
Every open finding gets patch, compensate, or accept — documented. Original Cyberlium.
Accepting risk without a ticket is not a strategy — it is how lab VMs become lesson plans for attackers.
Remediation paths for confirmed findings on $LAB_ASSETS: Patch (apply vendor fix), Compensate (WAF rule, disable service, segmentation until patch), Accept (document risk with approver and review date — lab scenario only). Prefer patch when fix available and testable on YOUR VM. Compensating controls must be specific. Accept is last resort with expiry — not 'ignore scanner forever.' Never plan remediation for stranger infrastructure you scanned without authorization. No exploit validation step — retest with scan or safe version check.
1. Patch path
Identify fixed version from advisory; test on lab clone; schedule maintenance window.
Record KB/advisory link and rollback note for lab VM snapshot.
Command guide
Try these commands — Patch path
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: python3, curl. Reference sites: Remediation planning (https://www.cisa.gov/topics/cybersecurity-best-practices); Patch management (https://nvd.nist.gov). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Compensate path
Temporary: firewall rule, disable vulnerable module, remove exposure.
Document compensating control ID and retest date — not permanent silence.
3. Accept path
Lab only: business justification, approver name placeholder, review date 90 days.
NEVER accept Critical on internet-facing production you do not own — out of scope.
4. What you ship: remediation option matrix
Patch/Compensate/Accept definitions + one example each from lab report.
5. What you record before the next lesson
Remediation matrix path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Mark all employer prod findings Accepted without ticket or authority.
- Right: Name three remediation paths. Next: owners and dates.
Mission: remediation matrix
1) Define Patch Compensate Accept. 2) Assign path to three lab findings. 3) Write NEVER remediate unauthorized targets.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When compensate beats emergency patch?”
APPLY: Preferred remediation:
APPLY: True or False: Accept without ticket is fine.
APPLY: Compensating control:
Owners and Dates
Part of Vulnerability Assessment — Remediation Planning.
Retest
Part of Vulnerability Assessment — Remediation Planning.
Remediation Lab
Part of Vulnerability Assessment — Remediation Planning.