Risk intelligence: deciding which security fixes come first
When a security team has hundreds of open issues and time for only a fraction of them, the order of work matters as much as the work itself. A conglomerate came to us with more than 400 findings, ten engineers and 30 days. It needed to know which few problems could do real damage to the business.
SEVERITY
EXPLOIT
ASSET
EXPOSURE
BUSINESS
= One prioritized repair queue
Three businesses, one security team
The group owned a bank, a hospital and an e-commerce business, all served by a single security team. Every application owner argued that their system should be fixed first. The board’s request was simple: “Give me the ten that could kill us.”
Why the usual ranking failed
The team had been sorting work by CVSS, the standard severity score from 0 to 10. That score describes a flaw in isolation. It says nothing about whether the system handles payments or patient records, or whether an attacker on the internet can even reach it. As a result, a medium issue on a back-office tool sat above a critical one on an internet-facing payment service.
How we ranked the work
We combined five factors into one score for every finding: severity, how easy it is to exploit, how important the affected system is, how exposed it is to the internet, and what it would cost the business if things went wrong.
- A workshop with the business to rate each system by the money it handles, the volume of personal and patient data it holds, its uptime commitments and the rules it falls under (from OJK, Bank Indonesia and the Personal Data Protection Law, UU PDP)
- An exploitability check covering whether public attack code exists, how many steps an attacker would need, and whether other controls already block the attack
- Business weighting based on transaction value, patient safety and the hourly cost of an outage
- A ranked queue, with a short explanation of why each item sits where it does
Where severity and real risk parted ways
The top ten by severity score and the top ten by business risk shared only three items. The other seven real top risks scored between 6 and 8, but they faced the internet and touched payments or patient data.
The number one risk was a flaw in how payment confirmations were handled, on a flow carrying about Rp40 billion a day. Its severity score was 7.5. It ranked well above a 9.8 on a back-office server that no outsider could reach. Before the reranking, about 60% of the team’s effort had been going to risks in the bottom half of the list.
What happened next
The board funded a 12-item repair plan built from the ranked list, and the team worked through it. Arguments about priority largely stopped, because every item now came with a score and a reason. The group reuses the model every quarter, and new findings are scored automatically as they arrive.
Organizations where every finding is labeled critical, and where several businesses compete for one security team, face exactly this problem of deciding what comes first.