Prioritising a remote-access appliance under a three-engineer patch cap
Northwind Logistics runs 14,000 Windows and Linux endpoints across 22 sites. Its vulnerability team has three engineers and one monthly patch window. The latest scan produced 1,860 findings rated CVSS 9.0 or above. Of those, 240 sit on internet-facing hosts and 38 are on a payment-processing subnet that is audited annually. Threat intelligence reports that a financially motivated group is exploiting a remote-code-execution flaw in a remote-access appliance. That appliance appears 11 times in the scan, but the scanner cannot authenticate to it, so it reports only an inferred firmware version. The vendor confirms a fixed release; applying it takes a 30-minute outage per appliance and needs emergency change approval. Two older warehouse systems cannot run the supported scanning agent, and the service desk reports that warehouse staff routinely disable the local firewall to keep a label printer working. The board wants a one-page decision: what to fix first, what to accept, and who owns the residual risk.
1. Set out the first 14 days of remediation. Which findings do you fix, in what order, and what criteria drive the order?
Read the worked answer
Criteria. CVSS alone is not a priority. I would rank on confirmed exposure and exploitability, asset criticality and data sensitivity, confidence in the finding, availability of compensating controls, and change cost or downtime. The scanner's inferred firmware version is not evidence, so the first move is authenticated validation of all 11 appliances, not a blind emergency change.
Days 1-3. Validate the appliance instances through the vendor console or an authenticated scan. If the exploitable version is confirmed, raise an emergency change: remote access plus active exploitation outweighs a 30-minute outage. Patch in pairs so remote access remains available. At the same time, block known exploitation indicators at the edge and hunt for webshells or new local accounts.
Days 4-7. Work the 240 internet-facing findings by exploit availability and business service. The 38 payment-subnet findings come next only where they are reachable from the internet or from a compromised host; a CVSS 9.0 on an isolated internal host can wait behind a compensating control. Use virtual patching or WAF rules where the vendor patch needs a longer window.
Days 8-14. Fix the warehouse control failure. The disabled firewall is an unmanaged path. Isolate the label printer on a small VLAN with a local print server and a deny-by-default rule, then enforce firewall tamper alerts. If the old systems cannot take the agent, restrict them to a dedicated segment and monitor their traffic.
Record every deferred item with an owner, compensating control and review date. The goal is not zero findings; it is reducing reachable, exploitable risk first.
2. The warehouse director refuses the firewall change and asks the board to accept the risk. What must a defensible risk acceptance contain, and what would you recommend?
Read the worked answer
A defensible acceptance is not an email saying the risk is accepted. It needs a plain-language risk statement covering the data and services exposed and the plausible threat; the failed control, namely staff disabling the firewall; likelihood and impact, including regulatory impact; the compensating controls actually in place; the residual risk; a named owner with budget authority; a time limit; and the evidence that cheaper remediation was considered. The board should see the cost of the printer VLAN against the potential loss.
I would recommend refusing a permanent acceptance. The risk is not just the old printer; it is a cultural control failure in which staff routinely disable security to keep production running. The compensating package should isolate the printer on its own VLAN with a local print server and ACLs allowing only that server, contain broadcast traffic, add endpoint detection to warehouse systems, and alert when a host firewall is disabled. Set a 90-day acceptance only if the plant manager signs it and funds the VLAN work. The CISO should retain a monitoring obligation, and the risk register should show the accepted residual risk. If the director still refuses, escalate to the board with the specific decision and consequences, because operational convenience cannot silently override a known exploitable path.