Prioritise a finding list that the severity column gets wrong

applied · 80 min · Objective 4.3

Task

Take a set of findings and order them for remediation, then show that sorting by CVSS produces a different and worse order than sorting by exposure, asset criticality and known exploitation. The gap between the two orders is the argument for context.

Steps

  1. Write /tmp/findings.csv with fifteen synthetic findings, columns id,host,cvss,internet_facing,asset_criticality,exploit_available,compensating_control. Make sure at least three are high-CVSS internal findings with no known exploit, and at least two are medium-CVSS internet-facing findings with public exploit code.
  2. Produce order one: sort by CVSS descending, and write the top five to /tmp/order-cvss.txt.
  3. Now build a context score. Write /tmp/prioritise.py combining CVSS with exposure, criticality, exploit availability and any compensating control — you choose the weighting, and you must be able to defend it.
  4. Produce order two into /tmp/order-context.txt.
  5. Compare the two top-fives and identify every finding that appears in one and not the other.
  6. For each of those, write one sentence on what would have happened had you worked the CVSS order: which real risk sat untouched while somebody patched an internal medium-impact issue.
  7. Record the whole comparison in /tmp/prioritisation.md, including the weighting you chose and why.

Verify

head -5 /tmp/order-cvss.txt
head -5 /tmp/order-context.txt
python3 - <<'PY'
a=[l.split(',')[0] for l in open('/tmp/order-cvss.txt') if l.strip()][:5]
b=[l.split(',')[0] for l in open('/tmp/order-context.txt') if l.strip()][:5]
print('cvss order   :',a)
print('context order:',b)
assert a!=b, 'the two orders are identical - the findings lack the contrast the lab needs'
moved=set(b)-set(a)
assert moved, 'nothing was promoted by context'
print('promoted by context:',sorted(moved))
PY
grep -ciE "weighting|exposure|exploit" /tmp/prioritisation.md

The assertion requires the two orders to genuinely differ and requires at least one finding to have been promoted by context. If they match, the synthetic findings are too uniform — go back and make sure some high-CVSS issues are internal and unexploited while some medium ones are internet-facing and under active exploitation.

Notes

The weighting you chose is the part worth defending, and there is no universal right answer. What is not defensible is having no weighting at all: sorting a scanner export by severity and working down it is the most common vulnerability management process there is, and it reliably leaves the exploited internet-facing medium sitting below three internal criticals nobody can reach.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.