Question

A security analyst runs a monthly authenticated vulnerability scan across a mixed environment. The report lists over 4,000 findings ranked by raw CVSS base score. Management asks the analyst to prioritize remediation efforts to reduce actual organizational risk most effectively. Several 'Critical' CVSS findings are on internal test servers with no sensitive data and no external exposure, while a 'High' finding affects an internet-facing payment processing system holding cardholder data. What should the analyst do FIRST to prioritize remediation?

Accepted Answer

Adjust prioritization by applying asset value, exposure, and threat context to the CVSS base scores before assigning remediation order

Answer

Remediate strictly in descending order of CVSS base score, starting with all Critical findings

Answer

Rescan using an unauthenticated scanner to reduce the number of reported findings to a manageable count

Answer

Accept all findings below Critical severity as residual risk and remediate only the Critical items