Compensating Controls for an Unpatchable Internet-Facing Appliance
A retailer’s six internet-facing load balancers run firmware with a CVSS 9.8 unauthenticated remote-code-execution flaw. The vendor will release a patch in 45 days. Asset inventory shows two load balancers are end-of-life and one sits in a PCI cardholder-data environment. The latest scan also lists 1,200 findings, 30 of them critical, including TLS 1.0 on an internal HR application. The VP of IT wants to accept risk on all critical findings until next quarter. The security team has a WAF in detect-only mode, a limited maintenance window, and no formal exception process. A business unit is launching a customer promotion in 10 days that will double internet traffic. You must rank remediation actions, advise on the VP’s blanket risk acceptance, and define how to prove compensating controls work.
1. Rank the top three remediation actions and justify the ranking using exposure, exploitability, and business impact.
Read the worked answer
Rank by exposure, exploitability, and business impact, not by CVSS alone.
- Internet-facing load balancers with CVSS 9.8 unauthenticated RCE. These are directly reachable, have a severe flaw, and one is in the PCI zone. Put the WAF into blocking mode with virtual patching for the specific CVE, restrict management access to a jump host and allowlisted IPs, and segment the PCI load balancer from other environments. If the WAF rule cannot be tuned safely, take the two end-of-life units out of service and place the remaining behind stricter ACLs.
- End-of-life load balancers. Even with a WAF, unsupported firmware cannot receive future patches. Plan replacement or isolate them to a non-production, non-PCI function.
- Internal TLS 1.0 HR application. Lower internet exposure but a compliance and credential-risk issue; disable TLS 1.0 after confirming client compatibility, and monitor for fallback.
The other 27 critical findings need triage by asset criticality and exploit availability, not blanket deferral.
2. The VP of IT proposes accepting risk on all critical findings until next quarter. What is wrong with that, and what should a defensible exception request contain?
Read the worked answer
A blanket risk acceptance is not defensible because it does not identify asset, threat, compensating control, residual risk, owner, or expiry. It also conflates a 45-day vendor delay on one appliance with 30 unrelated findings.
An acceptable exception request should contain:
- Specific finding IDs and affected assets, with PCI and internet-facing scope called out.
- Business rationale and why remediation cannot occur before next quarter.
- Compensating controls: WAF blocking rule, ACLs, segmentation, enhanced logging, and monitoring frequency.
- Residual risk statement and likelihood/impact, including regulatory exposure.
- Time-bound expiry, review date, and named risk owner.
- Validation evidence that the compensating controls work.
- A rollback or emergency-patch trigger if exploit activity is detected.
Approve exceptions per finding or per coherent group, not as a blanket quarter-long acceptance. Require the VP to own residual risk in writing. The 10-day promotion increases exposure, so internet-facing items need action before traffic doubles.
3. How would you validate that the WAF and other compensating controls actually work, rather than merely existing on paper?
Read the worked answer
Prove controls with tests that mimic the threat and with evidence that the control is inline.
- WAF: replay a benign request that matches the CVE pattern and a known exploit attempt on a canary path; confirm block, log, and alert. Check that the rule is blocking on every load balancer, not just the primary.
- ACLs: run an external scan from allowed and disallowed sources; confirm management ports are unreachable from the internet and from non-jump hosts.
- Segmentation: attempt SMB and management access from a non-PCI segment to the PCI load balancer; confirm deny and log.
- Logging: verify WAF, firewall, and load balancer logs reach the SIEM and trigger an alert within the defined SLA.
- TLS: use a scanner to confirm TLS 1.0 is disabled and no fallback path remains.
Document test date, tester, evidence, and failure remediation. A control that is configured but untested is an assumption, not a compensating control. Re-test after the promotion changes traffic patterns.