Nine Months to a Patch
An air traffic services unit operates a track server that fuses radar and ADS-B data for 12 controller positions. It runs an operating system version for which a critical vulnerability has just been published: CVSS 9.8, remotely exploitable without authentication, public exploit code available. The server sits on a legacy flat VLAN shared with a maintenance laptop used by the radar vendor, and it has no internet access. The operating system vendor will not certify a patch for this deployment for at least nine months because the platform is in a safety-assurance configuration; installing an uncertified patch would itself require a safety assessment. A security audit last month found shared administrator accounts, no forwarding of logs to the SIEM, USB ports enabled on the server, and no network intrusion detection on the VLAN. The national supervisory authority has asked for a documented decision on the vulnerability within 30 days, covering residual risk and compensating controls.
1. Construct the risk assessment for this vulnerability in this deployment: which factors reduce likelihood, which increase it, and what is the resulting position for a safety-relevant service?
Read the worked answer
Start by de-rating the CVSS score. 9.8 is a context-free base score. It describes the vulnerability, not this exposure.
Factors reducing likelihood: no internet route; the VLAN is segmented from corporate IT; the application is bespoke and exploit code is usually written against default configurations; an attacker needs a foothold on that VLAN.
Factors increasing likelihood: the VLAN is flat and shared with a vendor maintenance laptop - a textbook pivot point, since vendor laptops are frequently unmanaged and are a well-documented initial-access vector; USB ports are enabled, and removable media remains one of the most common routes into operational technology; shared administrator accounts mean no attribution, no individual accountability, and credential reuse across the estate; no log forwarding means detection is effectively absent, so an intruder could dwell indefinitely; no intrusion detection on the VLAN removes the last chance of noticing.
Impact: loss of fused surveillance data across 12 positions - capacity restriction, reversion to procedural control, potential effect on separation. Impact is high and it is simultaneously a safety consequence. The safety assessment must therefore consider malicious as well as accidental causes of failure; a crash caused by an exploit is a safety event, not only a security event.
Resulting position: likelihood moderate rather than low, impact high, detection near zero. That combination is not acceptable without treatment, even though the server is not internet-facing.
2. Define the compensating controls and the decision you would put to the accountable manager, with evidence and exit criteria.
Read the worked answer
Immediate technical controls (0–30 days):
- Replace the flat VLAN with strict access control: only the radar feeds and the specific display consumers may reach the server; move the vendor laptop to a separate management VLAN behind a jump host with MFA.
- Disable USB in firmware and physically block the ports; enforce removable-media control.
- Retire shared administrator accounts for named accounts with MFA through the jump host.
- Forward authentication, OS and application logs to the SIEM; enable file-integrity and process monitoring; add intrusion-detection signatures for the published exploit path.
- Test offline backup and restore, since integrity of recovery is the last line of defence.
Evidence to place before the accountable manager: a test showing the new access rules block the exploit path from both the maintenance VLAN and a display subnet; a demonstrated SIEM alert; verification that USB control cannot be bypassed locally; and the patch timeline from the vendor.
Decision: accept and monitor rather than patch now - because an uncertified change to a safety-assured platform may cause a failure with higher probability than the exploit, while the exposure is materially reduced by segmentation and detection. Residual risk is low but not zero.
Governance: named risk owner, sign-off by the accountable manager, review every 30 days, automatic expiry when the certified patch is available or when the exposure changes (new vendor laptop, remote access, new VLAN member). Exit criteria stated in advance.
3. The regulator asks why you did not simply apply the vendor's operating system patch.
Read the worked answer
Because the patch is itself a change to a safety-assured system. The platform is in a certified configuration; an uncertified operating system change requires impact analysis, regression testing and operational validation. Nine months is the vendor's certification lead time; a 30-day window cannot absorb a full safety regression plus operational validation across 12 positions.
The comparison is between two risks, not between security and convenience. Option A, patch now: unknown interaction with the application, loss of vendor support, possible new failure modes, and no tested rollback - a failure mode with an unquantified but potentially higher probability than exploitation, occurring immediately rather than potentially. Option B, accept and monitor: exposure reduced by segmentation, strong access control, removable-media control and detection, with a bounded review period. Option C, remove the server from the vulnerable configuration (isolate, rebuild, virtualise or replace) - often the best long-term answer and worth evaluating during the nine months. Option B is defensible only because the compensating controls are real and verified; without them, accept-and-monitor would not be defensible at CVSS 9.8.
What the answer must contain: the documented option comparison; the verification evidence for each compensating control; the residual risk statement with owner and expiry; notification of the safety assessment body and the national CERT where required; and the commitment that the decision is time-bound and re-opened on any change to the exposure. The regulator is testing whether the decision was reasoned and recorded, not whether a patch was applied on a particular day.