The risk register (security as a programme)

An ordinary system redrawn with every door an attacker could use marked on it. Drawn honestly, any real system has more marked doors than a team has hours. This lesson is about choosing which door to fix first, and writing the choice down.

Before you start. The Security Mindset gave you the threat model, a written list of ways a system could be abused. Application Hardening gave you the CVE: a public id for one known hole in one piece of software, so a team can check whether it carries it. The trace you would actually see (detection and the first hour) showed that every alert threshold is a trade. This lesson takes all three up one level, to the question every security team answers every week: we cannot fix everything, so what first?

The idea in 30 seconds

Log4Shell (CVE-2021-44228, reported privately on 24 November 2021, public 9-10 December) scored 10.0 and was exploited at once, and every team had to decide what to fix first.
A risk register lists each risk with its likelihood, impact, owner and decision, and risk is likelihood times impact.
Every risk gets one of four decisions: fix, accept with a reason and a date, transfer, or avoid.
CVSS scores how bad a flaw could be in general; whether it is being used comes from CISA’s KEV catalogue and EPSS, and where it sits comes from you.
A patch deadline written before the emergency says how fast each kind of flaw gets fixed.
Coordinated disclosure tells the fixers first and the world with the fix, and phishing is a high risk with no CVE at all.

Read the story · Skip to the numbers