Caldervale Health: The 9.8 Nobody Owns
Caldervale Health is a 3,400-staff hospital network running an internet-facing patient portal. A penetration test found an unpatched deserialization vulnerability in the portal's authentication service, scored 9.8 by CVSS, allowing unauthenticated remote code execution. The portal vendor says a patch will be available in six weeks. The only compensating control is a web application firewall in blocking mode, but its rule set was last tuned eight months ago. Separately, multi-factor authentication is not enforced for 1,900 clinical user accounts because clinicians say the token adds 90 seconds to each login during ward rounds. The estate carries 214 open critical vulnerabilities, with median remediation at 96 days against a policy of 30. A neighbouring hospital network was hit by ransomware three weeks ago and diverted ambulances for four days. The board has asked the CISO for 'a number that represents our exposure.'
1. Rank the three exposures - the 9.8 portal vulnerability, unenrolled MFA on 1,900 clinical accounts, and the critical vulnerability backlog - and justify the order without simply citing CVSS.
Read the worked answer
Rank by realistic loss, not by score.
MFA for 1,900 clinical accounts - highest. MFA is the control that most reliably defeats credential-based intrusion, and 1,900 unenrolled accounts on an internet-facing portal are an exploitable path today. The 90-second objection is a workflow problem with a workflow solution: conditional access (MFA on new device or new location rather than every ward-round login), fast-pass sessions, and badge or push authentication. Pilot on one ward, measure the actual time cost, publish it, then mandate. This is a change-management task with a technical component, and should be run by someone who has done change management.
The 9.8 portal vulnerability - urgent but time-bounded. First verify the WAF rule actually covers this CVE; an eight-month-old rule set probably does not. An untested compensating control is an assumption, not a control. Put the vendor on a contractual clock, have the pen-test team attempt exploitation through the WAF, and consider restricting the portal geographically or to VPN as an interim measure.
The 214-critical backlog - systemic, not a sprint. A 96-day median against a 30-day policy means either the policy is unrealistic for the estate or the process is broken. Segment it: internet-facing and easily exploited goes to a fast lane; the rest gets risk-based exceptions with owners and expiry dates.
A 9.8 on a well-defended internal system is less dangerous than a 7.5 on an internet-facing one with no MFA.
2. Who should accept the residual risk of a six-week patch delay, and what record would you require before it is accepted? Where would you refuse to sign?
Read the worked answer
Ownership. Residual risk on a clinical system belongs to the accountable business owner - the Chief Medical Information Officer or the COO for clinical operations - not to the CISO. The CISO advises, quantifies and monitors; the business owns the consequence. If the CISO signs every acceptance, the organisation has found a scapegoat rather than a control.
Record required before accepting a six-week delay:
- Written acceptance naming the owner, the specific vulnerability or control gap, the exposure window with a hard end date, and the compensating controls.
- Evidence, not assertion. A WAF test against this CVE specifically, not a statement that the WAF is enabled.
- Enhanced monitoring - logging and alerting on exploitation attempts, with a named person responsible for watching it.
- A re-decision trigger: if the vendor slips, the acceptance expires and the portal is restricted or taken offline.
- Entry in the risk register with a score, an owner and a review date, reported to the risk committee.
Where I would refuse to sign: where loss of the system could cause direct patient harm; where the compensating control is untested; or where the accepting owner has not had the real consequence explained in plain language. A signature obtained without understanding is not risk acceptance - it is a liability transfer with nothing behind it.
3. The board asks for 'a number that represents our exposure.' How do you respond?
Read the worked answer
Do not invent a single number, and do not refuse the question. A dollar figure manufactured for a board will be quoted back at you in the post-incident review. Give a range, with method and stated assumptions.
Approach: start from scenarios the board already understands. For a hospital network the credible ones are: portal compromise leading to diversion of clinical services; ransomware on clinical systems; and third-party breach of patient data. For each, state an impact band - downtime hours multiplied by cost per hour of diverted service, plus recovery cost, plus regulatory penalty exposure - and a likelihood band over 12 months. Multiply to a range and say plainly that it is a range and why.
A defensible opening line: 'Our two highest-consequence scenarios are X and Y. Each has a plausible impact of $A–$B. Current controls reduce likelihood but not impact. We are investing $C to change that, and here is the measure that tells you in 90 days whether it worked.'
What the board actually needs is a decision, not a score. Offer three options: accept; mitigate at a stated cost over 12 months; or transfer through cyber insurance with the limit and exclusions spelled out. Boards can choose between options; they cannot act on a vulnerability score.
State the limitation honestly - any quantification rests on assumptions about attacker behaviour and downtime cost. Publishing those assumptions is what lets the board challenge them, and that is the point of the exercise.