Phase 07–08 · Remediation & retest
Remediation & Retest
Findings become value only when someone owns them and the fix is proven. Every item below carries a named synthetic owner, a target date, a priority, and an interim compensating control where the fix takes time.
Retest workflow
The sequence every finding follows before it can be closed.
- 01
Finding
Validated weakness recorded with evidence and confidence.
- 02
Remediation implemented
Owner ships the fix; compensating control covers the interim.
- 03
Evidence reviewed
Configuration, code, or policy evidence checked against the recommendation.
- 04
Retest
Independent re-validation using the original validation approach.
- 05
Pass / Partial / Fail
Result recorded honestly, including partial fixes.
- 06
Closure decision
Closure, risk acceptance with an owner, or return to remediation.
A change is not a closure
A finding is not considered closed solely because a change was made. Closure requires evidence that the change addresses the underlying weakness, plus a retest proportionate to the risk: a Critical or High finding is re-validated directly against the original condition, while a Low configuration item may be closed on reviewed configuration evidence. Partial results stay open with the residual risk stated, and risk acceptance is recorded against a named owner rather than treated as a fix.
Remediation board
Ten tracked synthetic remediation items across four owning teams.
| Finding | Severity | Owner | Priority | Target date | Status | Compensating control | Retest |
|---|---|---|---|---|---|---|---|
| EH-001Broken access control in synthetic admin workflow | Critical | Platform Engineering (synthetic) | P1 | 2026-03-20 | Closed | Temporary network allow-list on the admin console while the fix shipped | Pass |
| EH-002Overly broad permissions assigned to synthetic test role | High | Identity Engineering (synthetic) | P1 | 2026-03-22 | Closed | Test role restricted to a non-production tenant during rebuild | Pass |
| EH-004Insecure test upload validation on lab endpoint | High | Platform Engineering (synthetic) | P2 | 2026-03-27 | Retested | Upload feature limited to a restricted lab tenant | Pass |
| EH-005Missing rate-limit control on lab authentication endpoint | Medium | API Platform (synthetic) | P2 | 2026-03-30 | Closed | Edge throttle applied ahead of the application-level control | Pass |
| EH-006Weak session timeout policy on synthetic portal | Medium | Platform Engineering (synthetic) | P2 | 2026-04-02 | Closed | Step-up authentication required for sensitive lab actions | Pass |
| EH-007Insecure default security headers on lab web tier | Medium | Platform Engineering (synthetic) | P3 | 2026-04-05 | Closed | Edge-level frame and transport protections while CSP was tuned | Pass |
| EH-008Secrets represented in a synthetic configuration example | Medium | Data Platform (synthetic) | P2 | 2026-04-08 | Evidence Review | Repository access narrowed while secret scanning is rolled out | Pass |
| EH-003Overly permissive network path between synthetic application and data tiers | High | Infrastructure (synthetic) | P2 | 2026-04-17 | In Progress | Flow logging with alerting on unexpected tier-to-tier connections | Not Retested |
| EH-009Stale synthetic service account remains enabled | Medium | Integration Team (synthetic) | P2 | 2026-04-21 | In Progress | Conditional access restricting the account to a known source range | Not Retested |
| EH-012Insufficient logging of privileged actions in lab admin console | Low | Platform Engineering (synthetic) | P3 | 2026-04-30 | Planned | Manual weekly review of administrative changes | Not Retested |
Before / after comparison
Five findings where remediation was implemented and the retest passed against reviewed evidence.
EH-001
Broken access control in synthetic admin workflow
Before
Administrative operation accepted a standard-role session; checks lived in the interface layer.
After
Deny-by-default server-side authorization per operation, covered by automated role tests.
EH-002
Overly broad permissions assigned to synthetic test role
Before
Test role inherited administrative entitlements unrelated to its purpose.
After
Least-privilege role rebuilt from documented requirements with quarterly attestation.
EH-004
Insecure test upload validation on lab endpoint
Before
Server trusted client-declared content type for lab uploads.
After
Server-side allow-list validation, isolated storage, non-executable content headers.
EH-005
Missing rate-limit control on lab authentication endpoint
Before
No throttling or lockout signalling on the lab authentication endpoint.
After
Per-identity and per-source limits with progressive delay and failure-rate alerting.
EH-006
Weak session timeout policy on synthetic portal
Before
Idle sessions persisted far beyond the documented standard.
After
Idle and absolute lifetimes aligned to policy; sessions invalidated on role change.