Unit 11: Hardening network devices · Lesson 4 of 4 · 18 min

Patching and backups by risk

Join the device inventory with a list of actively exploited versions, then find devices with stale backups or no vendor support.

mission

You are
The engineer planning this month's network maintenance.
Situation
The device inventory is ~/devices/inventory.csv and the versions with known active exploitation are in exploited-versions.txt.
Goal
Order the work: exploited versions first, then unsupported devices, then stale backups.
Hand in
A prioritised list for the change board.

Patch priority

  1. Known exploited and internet facingwithin days, or isolate
  2. Known exploited, internalthis maintenance window
  3. Out of vendor supportreplace; no fixes will come
  4. Everything elsenormal patch cycle
01

Read the inventory

One row per device, with its version, support end date and last config backup.

analyst@net-lab
cat inventory.csv
device,role,os,version,end_of_support,last_config_backup
core-rtr1,core router,netOS,17.9.4,2029-03-31,2026-10-13
edge-rtr2,branch router,netOS,15.2.7,2023-12-31,2025-02-11
sw-floor1,access switch,netOS,16.12.4,2027-06-30,2026-10-13
sw-floor2,access switch,netOS,17.9.4,2029-03-31,2026-10-13
sw-floor3,access switch,netOS,16.12.4,2027-06-30,2026-01-05
fw01,edge firewall,fwOS,9.1.4,2027-09-30,2026-10-12
vpn01,vpn appliance,vpnOS,22.7R2.1,2028-12-31,2026-08-30
cat
Prints the contents of one or more files. Built into Linux and macOS.
02

Match exploited versions

grep -F -f matches every fixed string from a file at once.

analyst@net-lab
awk -F, 'NR>1 {print $3" "$4" "$1}' inventory.csv | grep -F -f exploited-versions.txt
netOS 15.2.7 edge-rtr2
netOS 16.12.4 sw-floor1
netOS 16.12.4 sw-floor3
vpnOS 22.7R2.1 vpn01

you should see Four devices run versions with known exploitation, including the internet-facing VPN appliance.

awk
Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
grep
Prints the lines of text that match a pattern. Built into Linux and macOS.
03

Find unsupported devices and stale backups

ISO dates compare correctly as text, so awk can test them directly.

analyst@net-lab
awk -F, 'NR>1 && $5 < "2026-10-14" {print $1, $5}' inventory.csv
edge-rtr2 2023-12-31
awk -F, 'NR>1 && $6 < "2026-09-14" {print $1, $6}' inventory.csv
edge-rtr2 2025-02-11
sw-floor3 2026-01-05
vpn01 2026-08-30

you should see edge-rtr2 is out of support and its last backup is from February 2025.

defender tip A config backup is also your baseline. Without a recent one you cannot rebuild a device or prove it was changed.

04

Group devices by version

Standardising versions makes patching faster and testing simpler.

analyst@net-lab
tail -n +2 inventory.csv | cut -d, -f3,4 | sort | uniq -c
      1 fwOS,9.1.4
      1 netOS,15.2.7
      2 netOS,16.12.4
      2 netOS,17.9.4
      1 vpnOS,22.7R2.1

you should see Five different versions across seven devices.

tail
Prints the last lines of a file, or follows it as it grows with -f. Built into Linux and macOS.
cut
Keeps only chosen columns or characters from each line. Built into Linux and macOS.
sort
Sorts lines of text. Built into Linux and macOS.
uniq
Collapses repeated neighbouring lines. With -c it counts them. Built into Linux and macOS.

What a defender takes away

  1. 1Patch by exploitation and exposure, not by version number alone.
  2. 2Replace devices that no longer get fixes.
  3. 3Back up configs daily; they are your restore point and your baseline.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.