Loud voices, quiet risks

The organization

Organization: Larkspur Ridge Credit Union (fictional)
Industry: Financial services: a member-owned credit union with 12 branches and online banking
Size: About 38,000 members and 220 employees; a five-person IT team with one security analyst
Risk appetite: Low tolerance for member data exposure or fraud; moderate tolerance for internal operational risk.

Constraints

The regulator's annual examination starts next quarter.
The CFO has asked security to close the auditor's password finding first.
The largest business member has threatened to move its accounts if it is forced to change how it sends payroll files.

Remediation capacity: 2 findings. You can choose "Mitigate: remediate ("fix")" for at most 2.

You have 2 remediation slots.

F1 Actively exploited flaw on a retired loan-rate website

Marketing stopped using a loan-rate microsite two years ago, but it is still online. Its content-management plugin has a remote-code-execution flaw that is being actively exploited. Nothing links to the site, and no one has owned it since the marketing team reorganized.

Asset: Retired loan-rate microsite
Exposure: Internet-facing
CVSS base score: 9.8
Known to be exploited: Yes
Data involved: Public rate tables; the server shares a network segment with staff file shares
Compensating controls available: Block the site at the firewall
Remediation effort: Medium
Business owner: No current owner (formerly Marketing)

Your response to F1

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F2 Auditor finding: short minimum password length on the internal HR system

The internal audit report notes that the HR system accepts 8-character passwords. The system is reachable only from the corporate network, and every sign-in already requires multi-factor authentication. The CFO wants this closed first because it appears in the audit report.

Asset: Internal HR system
Exposure: Internal network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Employee records
Compensating controls available: Multi-factor authentication (already in place)
Lock accounts after repeated failed sign-ins
Remediation effort: Medium
Business owner: VP of Human Resources

Your response to F2

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F3 Largest business member sends payroll files over an unencrypted transfer

The credit union's largest business member uploads payroll files with employee names and bank account numbers over an old, unencrypted file-transfer service that uses one shared password. Moving them to the secure transfer channel means the member must change its process, and the member has threatened to move its accounts if forced to.

Asset: Legacy file-transfer service for business payroll files
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Payroll files with employee names and bank account numbers
Compensating controls available: Accept connections only from the member's network address
Rotate the shared password
Remediation effort: Medium
Business owner: VP of Business Banking

Your response to F3

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F4 Phone password resets verified only by name and date of birth

Member service representatives reset online-banking passwords over the phone after the caller gives the member's name and date of birth. No one has complained about the process. Adding a one-time code sent to the phone number on file is a procedure change the team can make within a week.

Asset: Member service password-reset procedure
Exposure: Business process
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Online-banking access to member accounts
Compensating controls available: Email the member after every reset (detects, doesn't prevent)
Remediation effort: Low
Business owner: VP of Member Services

Your response to F4

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F5 Mobile-app vendor contract has no breach-notification or liability terms

The credit union plans to sign a contract next month with a vendor that will build and host its new mobile app. The draft contract has no breach-notification deadline and no terms on who pays if the vendor causes a breach. The vendor has said it is open to negotiating.

Asset: Mobile-app vendor contract
Exposure: Third party
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Member data the app will process
Compensating controls available: Security questionnaire and annual review of the vendor
Remediation effort: Low
Business owner: VP of Digital Banking

Your response to F5

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

Overall note (optional, up to 1200 characters; shown back to you, never stored)

Your rationale and note are shown back to you once and never stored. Privacy