Defending a Critical Rating to a Skeptical CIO
A tester is finalizing a report for a 12-day test of a financial services web application. The draft has 37 findings: 9 rated Critical, 14 High, 10 Medium, and 4 Low. The CIO reviews the executive summary and says it is "alarmist" because the application has a WAF, a mature SDLC, and no known breaches. One Critical finding is an outdated Apache Struts library with CVSS 9.8, but the tester's exploit attempt was blocked by the WAF and no bypass was found. Another Critical is a business logic flaw allowing an authenticated user to change the amount field in a loan application; the tester confirmed it with two accounts and a $1 test transaction. The report is due to the board in 24 hours. The client wants the Struts finding downgraded to Medium because the WAF compensates. Some findings have raw HTTP evidence but no screenshots; the tester has not documented compensating controls consistently.
1. How should the tester decide the final rating for the Struts finding? Show the reasoning, not just a label.
Read the worked answer
Use the same risk rubric, not the CIO's comfort level. CVSS 9.8 is a base score; it does not automatically equal a Critical business finding. The WAF is a compensating control that can reduce likelihood, but only if its coverage is verified. The tester tried an exploit attempt and failed; that is weak evidence of exploitability, not proof of safety. A defensible outcome is likely High rather than Critical if the library is reachable but exploitation is constrained by the WAF, with an explicit note that the rating would rise if a bypass is found or the WAF rule is disabled. The report should state the base CVSS, the compensating control, the residual risk, and the validation performed.
Do not downgrade to Medium solely because the CIO asks; that understates the risk of an unpatched critical library and the possibility of WAF bypass. Recommend patching or virtual patching and verifying the WAF rule. Document the rationale so the board sees the reasoning. If the tester cannot verify WAF coverage, the safer rating is Critical with a note on uncertainty, because the control may fail silently.
2. How should the business logic flaw be communicated to the board, and what should the executive summary say?
Read the worked answer
The board summary should lead with business impact, not CVSS. For the business logic flaw, describe the scenario in plain language: an authenticated customer can alter the loan amount after the application is submitted, and the tester confirmed it with two accounts and a $1 transaction. State what that could mean: incorrect loan approvals, financial loss, regulatory findings, and reputational damage. Include the evidence strength ('confirmed in testing'), the affected process, and the immediate mitigation: server-side validation, independent approval, and transaction limits. Avoid blaming individual developers.
Use a one-page structure: what was tested, top three risks, what they mean to the business, and what to do first. Put the Struts finding in context: an outdated component with a critical base score, currently mitigated by the WAF but not patched; residual risk remains. Include a short management response if the CIO disagrees. The goal is informed decision-making, not alarm or reassurance. The executive summary should be accurate enough that a director can repeat the risk in one sentence and act on it.
3. The CIO asks you to remove the Struts finding from the board summary because it is 'not exploitable'. What do you do?
Read the worked answer
Do not remove the finding. An outdated Apache Struts library with a CVSS 9.8 base score is materially relevant even if the WAF blocked the tester's attempt. The board is entitled to know that a critical-severity component is present and that the control depends on WAF coverage. The tester can present it with context: no bypass was found in this engagement; residual risk is reduced but not eliminated; patching is still required. If the CIO wants to add a management response, include it verbatim with attribution.
If pressure continues, escalate to the engagement partner and quality lead and document the request. Removing a valid finding to make the summary more comfortable would misrepresent the risk and breach professional integrity. The tester should also offer to validate the WAF rule set after patching, so the client has a path to closure rather than a fight over the report. The finding can be explained, contextualized, and prioritized, but it should not be erased.