The 9.8 That Isn't the Biggest Risk
Northwind Mutual is a regional insurer with 800 employees and a six-person security team. Its annual security budget is $250,000, and internal audit just delivered 12 findings. Four are competing for funding this quarter:
(A) 200 Windows endpoints missing a patch for a CVSS 9.8 flaw that is exploitable only from inside the corporate LAN. (B) No MFA on the VPN used by 300 remote staff. Last year one phished password let an attacker in for four hours. (C) A public marketing web server running a CMS version with a known remote-code-execution flaw. (D) No formal asset inventory - nobody can say with confidence how many devices exist.
The CFO has seen the CVSS scores and wants (A) funded first because, in her words, 9.8 is the biggest number on the page.
1. Rank the four items for this quarter's funding and justify the order using something other than the CVSS score.
Read the worked answer
Reframe the question first. CVSS scores severity in isolation. It says nothing about whether an attacker can reach the asset, whether a working exploit exists for your environment, or what the business loses if it is used. Rank on likelihood × impact, where impact is measured against named assets.
Proposed order:
- (B) VPN MFA. Internet-facing, 300 users, and a credential-phishing intrusion has already succeeded once. Likelihood is demonstrated, not theoretical; impact is remote access to the core network. Cost is low relative to the other items.
- (C) Public CMS. Internet-facing and swept by automated scanners daily. RCE on an internet host is a classic first foothold. Patch or place a WAF in front this quarter.
- (A) Endpoint patch. Genuinely serious - but the flaw needs an attacker already inside the LAN, and (B) and (C) are the usual ways someone gets inside. Fund it, sequence it after the internet-facing gaps, and apply compensating controls (EDR blocking, network ACLs) in the interim.
- (D) Asset inventory. Foundational, but it is an enabler rather than a control. Fund it partially now, because you cannot verify the remediation of 1–3 without it.
The one-line argument: we are reducing the paths an attacker can actually walk, not ranking numbers.
2. Write the three-sentence explanation you would give the CFO, and state what you are explicitly accepting as residual risk.
Read the worked answer
Draft message to the CFO:
The 9.8 flaw can only be exploited by someone who is already inside our network, and today the two easiest ways in are our VPN without MFA and an out-of-date public website. Funding MFA and the website fix first closes the doors; the endpoint patch closes a window on an upper floor, and we are blocking that attack path with endpoint protection while it waits for the next cycle. If we fund the patch first instead, we spend the quarter hardening a room the burglar has to already be standing in.
What you are accepting, on the record:
- 200 internal endpoints remain exposed to a LAN-only exploit until the next patch window.
- Compensating controls are partial: EDR blocking rules can be bypassed by a determined attacker, and they do not fix the underlying flaw.
- Asset inventory stays incomplete, so the count of 200 endpoints is itself an estimate.
Why say it out loud: residual risk that is stated can be governed. Residual risk that is implied becomes the thing you are blamed for in the postmortem.
3. The CFO decides to defer item (A) anyway and asks you to 'just note it somewhere.' What does a defensible risk-acceptance record contain, and who signs it?
Read the worked answer
It is not a note - it is a decision with an owner. A defensible exception record contains:
- The risk in business terms: what could happen, to which assets, roughly how bad.
- Why it is being accepted: budget, operational constraint, dependency - stated plainly.
- Compensating controls in place, so the residual risk is smaller than the raw finding.
- A named risk owner - a business leader with authority over the affected systems, not the security analyst. The CFO or the CIO signs; the analyst documents and advises.
- An expiry date, typically one quarter, forcing a re-decision rather than a silent default.
- A trigger for early review: a new exploit in the wild, a related incident, or a change in exposure (for example, the endpoints becoming reachable from a VPN).
- Where it is tracked: the same risk register as everything else, with a review date, not buried in a ticket.
Judgement point: the security team's job is to make the trade-off visible and to set the review trigger. Refusing to document an accepted risk only guarantees that nobody will ever revisit it.