Re-rank the backlog with context you had all along

short · 50 min · Objective 2.3

Task

Take your scan backlog sorted by severity, add the context only you can supply, and produce a different order. Then write the deferral record for the finding you are choosing not to fix.

Steps

  1. Export your findings sorted by CVSS, highest first. This is the order a tool gives you and the order nobody should work in.
  2. Attach three context fields to each: which host, whether it is reachable from outside its segment, and what the host is for. Get exposure from the external-perspective scan rather than the inventory's claim.
  3. Attach a fourth: whether a public exploit is known, and whether the issue appears in a known-exploited catalogue.
  4. Re-sort. Write the new top ten and, for each, the single field that moved it.
  5. Pick one finding you are deliberately not fixing. Write the full deferral record: the finding, why not now, what compensating control exists, the evidence it was verified, the residual risk in business terms, who would accept it, and an expiry date.
  6. Take one compensating control you claimed and test it. If you said a firewall rule prevents reachability, try to reach the service from where an attacker would be.

Verify

awk -F, '$5>=7.0 {print $2}' /tmp/scan-cred.csv | sort -u | wc -l
comm -12 <(awk -F, '$5>=7.0 {print $2}' /tmp/scan-cred.csv | sort -u) <(sort /tmp/exposed-hosts.txt) | wc -l
nc -z -w 3 10.10.10.20 445; echo "reachable: $?"

The first is the backlog at high and above. The second is the subset on hosts that answered from outside the segment, and it is normally a small fraction -- which is the entire argument for context-based prioritisation. The third tests your claimed compensating control directly: a non-zero exit means unreachable, and anything else means the control you were about to write into a deferral record does not work.

Notes

Step 6 is what separates a compensating control from a hope. An unverified control in a deferral record is worse than no control, because it converts an open risk into one somebody believes is handled.

Keep the deferral record. The reporting lab aggregates these, and the point of aggregating is that twenty individually reasonable acceptances can add up to an unreasonable position that no single record shows.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.