Patching a Critical Vulnerability on the Production Line
A food manufacturer operates six production lines whose human-machine interfaces run an embedded operating system the vendor no longer patches. A vulnerability in the HMI web service carries a CVSS base score of 9.8 and is being actively exploited in the wild against internet-exposed instances. The HMIs are not internet-facing, but a flat plant network means an infected engineering laptop could reach them. The vendor's fixed firmware requires 36 hours of downtime per line, and each line contributes roughly $180,000 of margin per production day. Peak season begins in five months and the only acceptable maintenance window is a two-day shutdown in month four. Available in the interim: network segmentation between IT and the plant floor, application allow-listing on engineering workstations, and removal of the HMI web service where the local console is sufficient.
1. Decide the remediation path and justify the sequencing.
Read the worked answer
Attack the exploitability, not the score.
The 9.8 matters, but the operative question is reachability. Today the HMIs are reachable from any compromised laptop on a flat network. Three interim measures change that in days rather than months and cost almost no margin:
- Remove the HMI web service where the console suffices. This eliminates the vulnerable attack surface entirely on those lines - the strongest single action available and it requires no vendor firmware.
- Segment IT from the plant floor with an enforced boundary and no dual-homed engineering hosts.
- Allow-list on engineering workstations so an infected laptop cannot execute the payload.
With those in place, expected loss drops materially even though the underlying vulnerability remains. Firmware stays scheduled for the month-four window, line by line across the six lines - not all at once, because 36 hours across all six is $1.08M of margin and a single failed flash is a restoration problem, not a patch problem.
What is not acceptable: waiting five months with a flat network and an actively exploited vulnerability.
2. How should the accepted residual risk be documented and who signs it?
Read the worked answer
The documentation must make the assumption explicit, because the whole treatment depends on the interim controls holding.
Contents:
- Vulnerability and exposure statement: unpatched HMI, actively exploited, reachable from engineering workstations until segmentation is verified.
- Interim controls with evidence: which lines had the web service removed, segmentation test results, allow-list coverage percentage.
- Residual estimate: expected loss if the interim controls operate as designed, and the delta if segmentation fails.
- Condition that reopens the decision: any new exploit path, any line reconnected to the flat network, or slip of the month-four window.
- Timeline: dated commitments per line.
Signatory: the plant operations director jointly with the CISO. Patching decisions that cost production margin sit with the operations owner, but the security exposure judgement sits with security. A single signature from either side lets one function absorb a decision it does not own. Escalate to the executive committee if the two do not agree, rather than letting the decision default to whichever function is quieter.
3. Which metric best reports this to executive leadership?
Read the worked answer
Not patch compliance percentage - the platform can never be compliant, so the metric would sit at zero forever and stop carrying information.
Better: percentage of production lines where the vulnerable service is confirmed unreachable from an untrusted network, verified by test rather than by diagram. Report weekly with a target of 100% before the season and a hard floor of five of six lines at any time.
Supporting indicators:
- Age of the oldest unverified segmentation boundary.
- Count of days until the month-four window, with firmware readiness as a binary status.
- Any engineering laptop found dual-homed - the single most likely path to failure.
This framing measures the thing that actually reduces the risk (reachability), keeps attention on the interim controls rather than on a patch that cannot be applied yet, and gives leadership a number that can move in the right direction during the five-month gap.