Unit 11: Hardening network devices · Lesson 4 of 4 · 18 min

Patching and backups by risk

Join the device inventory with a list of actively exploited versions, then find devices with stale backups or no vendor support.

mission

You are
The engineer planning this month's network maintenance.
Situation
The device inventory is ~/devices/inventory.csv and the versions with known active exploitation are in exploited-versions.txt.
Goal
Order the work: exploited versions first, then unsupported devices, then stale backups.
Hand in
A prioritised list for the change board.

Patch priority

  1. Known exploited and internet facingwithin days, or isolate
  2. Known exploited, internalthis maintenance window
  3. Out of vendor supportreplace; no fixes will come
  4. Everything elsenormal patch cycle
01

Read the inventory

One row per device, with its version, support end date and last config backup.

analyst@net-lab
cat inventory.csv
device,role,os,version,end_of_support,last_config_backup
core-rtr1,core router,netOS,17.9.4,2029-03-31,2026-10-13
edge-rtr2,branch router,netOS,15.2.7,2023-12-31,2025-02-11
sw-floor1,access switch,netOS,16.12.4,2027-06-30,2026-10-13
sw-floor2,access switch,netOS,17.9.4,2029-03-31,2026-10-13
sw-floor3,access switch,netOS,16.12.4,2027-06-30,2026-01-05
fw01,edge firewall,fwOS,9.1.4,2027-09-30,2026-10-12
vpn01,vpn appliance,vpnOS,22.7R2.1,2028-12-31,2026-08-30
02

Match exploited versions

grep -F -f matches every fixed string from a file at once.

analyst@net-lab
awk -F, 'NR>1 {print $3" "$4" "$1}' inventory.csv | grep -F -f exploited-versions.txt
netOS 15.2.7 edge-rtr2
netOS 16.12.4 sw-floor1
netOS 16.12.4 sw-floor3
vpnOS 22.7R2.1 vpn01

you should see Four devices run versions with known exploitation, including the internet-facing VPN appliance.

03

Find unsupported devices and stale backups

ISO dates compare correctly as text, so awk can test them directly.

analyst@net-lab
awk -F, 'NR>1 && $5 < "2026-10-14" {print $1, $5}' inventory.csv
edge-rtr2 2023-12-31
awk -F, 'NR>1 && $6 < "2026-09-14" {print $1, $6}' inventory.csv
edge-rtr2 2025-02-11
sw-floor3 2026-01-05
vpn01 2026-08-30

you should see edge-rtr2 is out of support and its last backup is from February 2025.

defender tip A config backup is also your baseline. Without a recent one you cannot rebuild a device or prove it was changed.

04

Group devices by version

Standardising versions makes patching faster and testing simpler.

analyst@net-lab
tail -n +2 inventory.csv | cut -d, -f3,4 | sort | uniq -c
      1 fwOS,9.1.4
      1 netOS,15.2.7
      2 netOS,16.12.4
      2 netOS,17.9.4
      1 vpnOS,22.7R2.1

you should see Five different versions across seven devices.

What a defender takes away

  1. 1Patch by exploitation and exposure, not by version number alone.
  2. 2Replace devices that no longer get fixes.
  3. 3Back up configs daily; they are your restore point and your baseline.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.