jperezduerto.info
Security in depth · Unit 30 · Lesson 7 of 11
Severity is one input to a risk decision
Give two installations different priorities without rewriting their shared severity assessment.
Helpful before thisReporting: turn evidence into useful improvements
After this lesson you can
- Separate CVSS Base severity from a justified local remediation priority.
Keep the severity measurement intact while explaining the local decision.
Know which assessment you received
A CVSS Base assessment describes a vulnerability’s intrinsic severity. CVSS v4 also provides Threat and Environmental metrics for changing threat conditions and local context. Supplemental metrics add information without changing the numerical score. Calling every CVSS result simply “the risk score” hides these distinctions.
Assume a fictional vendor’s assessment applies to both installations below. Its version, vector, source, and publication date are retained in the review packet. The exercise concerns prioritization, not recalculating that vector.
Supplied priority records
- C1: Both installations have the same vendor CVSS v4 Base severity: High. No local Environmental assessment has been completed.
- C2: A supports public appointment booking. Unavailability interrupts today’s appointments; the owner must coordinate continuity and a maintenance window.
- C3: B holds synthetic training data. Its documented network isolation reduces exposure, but the current isolation state has not been verified.
Preserve the input; explain the decision
C2 supports urgent coordination for A. C3 supports considering a planned change for B, conditional on checking isolation and service needs. It does not support ignoring B forever or describing its underlying Base severity as Low.
If a team produces an Environmental assessment, identify its metric group, assumptions, and rationale separately. Even richer CVSS assessments do not contain every business consequence or determine an organization’s deadline automatically.
Write what would change the priority: an unexpected connection for B, current threat information, or a failed continuity plan for A. Preserve uncertainty instead of turning a diagram’s sequence into an automatic formula.
Model decision: Shared Base severity; different justified local priorities; B’s isolation remains a verification condition.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which report best uses C1-C3?
Show the answer
Correct answer: Retain the common Base assessment, explain different local priorities, and verify the isolation assumption. Intrinsic severity and local decision context are separate inputs. Documenting that distinction preserves comparability while making the priority defensible.
Try it
- WriteWrite one priority record for each installation: retained severity source, local consequence, proposed urgency, and one condition to verify. Model A as urgent coordinated remediation; model B as a scheduled review conditional on confirmed isolation, not permanent exemption.