TechKnowSurge
CompTIA CySA+ 2.5 NIST 800-53 RA-7
TechKnowSurge Catalog Interactives What Is Holding Up the Fix?
InteractiveSecurityFree

What Is Holding Up the Fix?

The license costs more than the budget, the shop goes down for a day, macros stop working, the vendor went out of business: what is holding up the fix?

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

The Vulnerability Remediation lesson lists what gets in the way of fixing a flaw. Cost: time, money and resources. A fix that needs new licenses, new hardware or paid work has to be sold to whoever controls the budget. Business process interruption: applying the fix stops or disrupts work the business needs, such as taking a system down during busy hours. Degraded functionality: the fix takes away a feature or capability people rely on, and it stays gone after the fix. Legacy or proprietary system: the system cannot be updated, because it is old and no longer patched, or because its maker is gone or it has been customized so much that updates no longer apply. The difference between interruption and degraded functionality is time: interruption is the work stopped while the fix goes in; degraded functionality is what is lost for good once it is in. The lesson also names agreements and compliance conflicts; those are left out of the cards because they overlap the other bins. When a fix is stuck, the lesson's next step is a compensating control, or recategorizing the flaw if it does not really apply. A quick test for each card: is the problem the bill, the downtime, what the fix takes away, or a system that cannot take the fix?

What you'll learn

Aligned to

CompTIA CySA+
2.5 Explain concepts related to vulnerability response, handling, and management.
NIST 800-53
RA-7 Risk Response

Key terms

Legacy System
An outdated computing system, hardware, or software that remains in use despite lacking current vendor support or security patches, often introducing security vulnerabilities.
Compensating Control
An alternative security measure implemented to offset a known risk or vulnerability when a primary control cannot be fully applied. A compensating control must provide an equivalent or greater level of protection.
Recategorization
The reassessment of a vulnerability's actual impact to an organization, which may result in lowering its priority or severity rating.

Topics

Vulnerability Management Remediation Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →