Five findings, two fixes

The organization

Organization: Tallgrass Outfitters (fictional)
Industry: Specialty retail: 30 stores plus e-commerce
Size: About 400 employees; a six-person IT team with one security analyst
Risk appetite: Low tolerance for customer-data exposure or payment disruption; moderate tolerance for internal operational risk.

Constraints

The holiday change freeze starts in two weeks.
A third-party processor tokenizes payments, so no card numbers are stored in company systems.
The cyber insurance policy renews next month.

Remediation capacity: 2 findings. You can choose "Mitigate: remediate ("fix")" for at most 2.

You have 2 remediation slots.

F1 Critical remote-code-execution flaw on the internet-facing VPN appliance

The vendor has released a patch for a remote-code-execution flaw in the VPN appliance that store managers and remote staff use. The flaw is being actively exploited. Patching needs a 30-minute outage after hours.

Asset: Remote-access VPN appliance
Exposure: Internet-facing
CVSS base score: 9.8
Known to be exploited: Yes
Data involved: Network access to internal systems
Compensating controls available: Allow VPN connections only from company-managed devices (partial)
Remediation effort: Low
Business owner: Director of IT

Your response to F1

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F2 Unsupported operating system on the legacy inventory reporting server

An on-premises server runs an operating system that no longer receives security updates. Scanners report several critical vulnerabilities. Its only job is a weekly inventory report that three people in finance use. The ERP system the company already licenses has a built-in report covering the same data; switching would take finance about a day.

Asset: Legacy inventory reporting server
Exposure: Internal network
CVSS base score: 9.8
Known to be exploited: No
Data involved: Inventory and cost data (no customer data)
Compensating controls available: Move the server to an isolated network segment
Restrict access to the three finance users
Remediation effort: High
Business owner: Controller (Finance)

Your response to F2

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F3 Residual wire-fraud risk from business email compromise

Finance already requires dual approval and a callback to a known phone number before changing a vendor's bank details. A tabletop exercise showed a skilled attacker could still succeed on rare occasions, and a single fraudulent payment could reach $250,000. The insurance broker is offering a social-engineering fraud rider at renewal.

Asset: Accounts payable process
Exposure: Business process
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Vendor banking details
Compensating controls available: Dual approval (already in place)
Callback verification (already in place)
Remediation effort: Medium
Business owner: Chief Financial Officer

Your response to F3

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F4 Customer database backups in a publicly listable storage bucket

A cloud storage bucket receives nightly copies of the customer database: names, email and shipping addresses, and order history. It was set to allow public listing during a migration last year and never changed back. Payment data is tokenized and not included. Fixing the access policy is a configuration change with no downtime.

Asset: Cloud backup storage bucket
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Customer personal data (no payment card data)
Compensating controls available: Turn on access logging (detects access, doesn't prevent it)
Remediation effort: Low
Business owner: Director of E-commerce

Your response to F4

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F5 Information-disclosure flaw in the internal wiki

A signed-in wiki user can see the titles, but not the contents, of pages in restricted spaces. The wiki is reachable only from the corporate network. The vendor has scheduled a fix for its next release, in about 60 days.

Asset: Internal wiki (IT runs it; Store Operations owns it)
Exposure: Internal network
CVSS base score: 4.3
Known to be exploited: No
Data involved: Page titles only
Compensating controls available: Rename sensitive page titles until the fix ships
Remediation effort: Low
Business owner: VP of Store Operations

Your response to F5

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

Overall note (optional, up to 1200 characters; shown back to you, never stored)

Your rationale and note are shown back to you once and never stored. Privacy