Question

A vulnerability scan of an internal ERP server reveals a medium-severity flaw with no available vendor patch. Remediation would require an application rewrite that the vendor cannot deliver for 18 months. The system is behind multiple network segmentation controls, and business leadership has decided the cost of replacing the ERP now outweighs the residual risk. As the security analyst, what is the MOST appropriate way to formally handle this vulnerability within the vulnerability management program?

Accepted Answer

Document a risk acceptance signed by the appropriate business owner, including the residual risk, justification, and a review/expiration date

Answer

Mark the finding as a false positive in the scanner so it no longer appears in reports

Answer

Immediately take the ERP server offline until the vendor provides a patched version

Answer

Ignore the finding because it is only medium severity and sits behind segmentation