Re-rank a findings list by exposure instead of severity

short · 40 min · Objective 4.1

Task

Take a list of findings ordered by severity score and re-order it by what actually matters: exposure, exploitability and asset value. The two orderings should disagree substantially, and where they disagree is the point.

Steps

  1. Build lab/findings.csv with twenty rows and columns id,cvss,internet_facing,exploit_known,asset_value,severity_rank,exposure_rank,decision,owner,reason,review_date -- the last three filled for every ACCEPT and left empty otherwise.
  2. Fill severity_rank by sorting on CVSS alone.
  3. Fill exposure_rank using the lesson's ordering: exposed AND exploited AND valuable first, then exposed and exploitable, then high severity but unreachable, then the rest.
  4. Count how many findings move more than five places between the two rankings, and name the single finding that moves furthest UP.
  5. Assign each finding one of the four outcomes -- remediate, mitigate, transfer, accept -- and for every ACCEPT record an owner, a reason and a review date.

Verify

awk -F, 'NR>1 && NF>=8 {n++} END {print n" finding(s)"}' lab/findings.csv
awk -F, 'NR>1 {d=$6-$7; if(d<0)d=-d; if(d>5) n++} END {print n" finding(s) moved >5 places"}' lab/findings.csv
awk -F, 'NR>1 && tolower($8) ~ /accept/ {n++} END {print n" accepted"}' lab/findings.csv
awk -F, 'NR>1 && tolower($8) ~ /accept/ && ($9=="" || $11=="") {n++} END {print n+0" accept(s) missing an owner or review date"}' lab/findings.csv

Twenty findings, at least three that move substantially, and 0 accepts missing an owner or review date. Every accept must carry both -- an unrecorded acceptance is indistinguishable from having forgotten.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.