Security8 / Field notes
Check. Fix. Verify.
Practical operational checklists · Published 17 October 2026. These are general guidance, not claims of laboratory testing or incident investigation.
1. Turn a KEV entry into a triage decision
- Establish applicability. Identify the deployed product, version and configuration. Confirm the affected range against the vendor advisory linked from the CISA entry. A name match alone is insufficient.
- Determine exposure. Record whether the affected service is internet-facing, its access controls and the business service it supports.
- Choose the action. Follow vendor patch or mitigation instructions. Record the owner, target date and any compensating control. Escalate suspected compromise through your incident-response process; patching alone is not incident resolution.
- Close with evidence. Retain the installed version, relevant configuration, change reference and validation result.
Primary reference: CISA KEV catalogue and each entry’s advisory links.
2. Investigate a missing HTTP security header
For a website you are authorised to assess, inspect response headers from the actual page and redirect destination:
curl -sS -D - -o /dev/null https://YOUR-DOMAIN.example/A GET request avoids relying solely on HEAD behaviour. Repeat for relevant application routes; a homepage result does not cover the entire application. Record the requested URL, status, redirect target and timestamp.
- HSTS: assess HTTPS readiness across the intended scope before changing policy or including subdomains.
- Content Security Policy: design around the application’s resources and test in report-only mode before enforcement. Copying an arbitrary strict policy can break legitimate flows.
- Cookies: examine actual session cookies and application behaviour. A public page without a session cookie cannot establish login-cookie security.
Primary references: OWASP HTTP Headers Cheat Sheet and OWASP CSP Cheat Sheet.
3. Preserve evidence before closing a finding
- Export the original result and record the exact target, time, check outcome and observed evidence.
- Record the remediation and change reference. Avoid putting credentials, session values or personal data in shared reports.
- Repeat the same check against the same target and route after the change.
- Compare individual observations. Investigate changed scope, redirects and scanner errors before marking the finding resolved.
- For controls that are not externally observable, obtain the appropriate internal evidence separately.
Use Security8’s scanner to export its returned observations and save an optional browser baseline. Read the comparison limitations before using a change as closure evidence.