Re-rank a findings list by exposure instead of severity

short · 40 min · Objective 4.1

Task

Take a list of findings ordered by severity score and re-order it by what actually matters: exposure, exploitability and asset value. The two orderings should disagree substantially, and where they disagree is the point.

Steps

  1. Build lab/findings.csv with twenty rows and columns id,cvss,internet_facing,exploit_known,asset_value,severity_rank,exposure_rank,decision.
  2. Fill severity_rank by sorting on CVSS alone.
  3. Fill exposure_rank using the lesson's ordering: exposed AND exploited AND valuable first, then exposed and exploitable, then high severity but unreachable, then the rest.
  4. Count how many findings move more than five places between the two rankings, and name the single finding that moves furthest UP.
  5. Assign each finding one of the four outcomes -- remediate, mitigate, transfer, accept -- and for every ACCEPT record an owner, a reason and a review date.

Verify

awk -F, 'NR>1 && NF>=8 {n++} END {print n" finding(s)"}' lab/findings.csv
awk -F, 'NR>1 {d=$6-$7; if(d<0)d=-d; if(d>5) n++} END {print n" finding(s) moved >5 places"}' lab/findings.csv
awk -F, 'NR>1 && tolower($8) ~ /accept/ {n++} END {print n" accepted"}' lab/findings.csv
grep -Eci 'review' lab/findings.csv

Twenty findings and at least three that move substantially. Every accept must carry an owner and a review date -- an unrecorded acceptance is indistinguishable from having forgotten.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.