Interpreting Organizational Needs Exercise

Prioritizing Findings

QUESTION:

Your organization, SwiftTech, recently underwent a security audit. During the audit, the assessor noted 4 findings that you need to address in your capacity as a GRC analyst outlined below:

One of the findings is a critical vulnerability in a web application. It will likely be difficult to fix immediately.
A separate finding is a high vulnerability in the web server that supports the same web application with the critical vulnerability. It will likely be relatively easy to fix.
Related to the same application, there are two medium vulnerabilities in the database that supports the application. They will be moderately difficult to fix.
Finally, there is a low level vulnerability related to credential management throughout the organization. It will be moderately difficult to fix.

The web application and the supporting infrastructure is scheduled to be decommissioned in the next 12 months. Knowing this, how would you prioritize fixing the vulnerabilities above? Why? Write a paragraph below outlining which items would be most important.

ANSWER:

There is probably no one "right" answer to this question. Your answer will likely depend on your organization's tolerance for risk and any policies that you might have defining when a vulnerability must be fixed. These types of policies are also dependent on your organization's risk tolerance (also known as risk posture).

If your organization, for instance, is somewhat risk averse (meaning you want to reduce risk as much as possible) you may choose to remediate every one of the flaws or choose to fix the critical and high vulnerabilities leaving the medium and low level vulnerabilities alone because the application is scheduled to be decommissioned relatively soon. This is probably the path that I would take. I'd likely choose to remediate the critical vulnerability because the application is scheduled to be decommissioned in a year. If the application was going to be decommissioned in 3 months, it might change my mind but a year is a long time to live with a critical web application vulnerability even if it will likely be difficult to fix. Fixing the high vulnerabilities that are easy to fix is a no-brainer. Fixing the medium and low vulnerabilities will likely come down to a discussion about just how much effort it will take to fix them vs. exactly how bad the vulnerabilities are.

In any case, if you choose to accept the risk of any vulnerability due to an application being decommissioned, you will likely need to create a management exception detailing exactly why the risk did not rise to the level that it needed to be fixed in accordance with your organization's typically vulnerability remediation schedule.

Next Concept