Prioritization and escalation

2.5 Explain concepts related to vulnerability response, handling, and management.

📘CompTIA CySA+ (CS0-003)

---

Prioritization is about deciding which vulnerabilities to fix first. Not all vulnerabilities are equally risky, so IT teams need to rank them to protect the system effectively.

Why Prioritization Matters

• Some vulnerabilities are critical, allowing attackers to take over servers or access sensitive data.
• Others are low risk, like a small software bug that doesn’t affect core operations.
• Resources (time, staff, tools) are limited, so you fix the most dangerous issues first.

Factors Used for Prioritization

1. Severity of the Vulnerability
   • Measured using systems like CVSS (Common Vulnerability Scoring System).
   • Scores usually range from 0 to 10.
     • 9–10: Critical
     • 7–8.9: High
     • 4–6.9: Medium
     • 0–3.9: Low
2. Impact on Business Operations
   • How badly will this affect servers, applications, or users?
   • Example: A vulnerability in a database server that stores confidential data is more serious than one in a test server.
3. Exposure or Accessibility
   • Can attackers reach it from the internet, or is it only accessible internally?
   • Internet-facing systems with vulnerabilities are higher priority.
4. Exploit Availability
   • If there are publicly available tools to exploit the vulnerability, it becomes urgent.
   • Example: A recent ransomware exploit targeting Windows Server increases priority.
5. Compliance Requirements
   • Certain vulnerabilities must be fixed to meet regulations or policies (like PCI DSS for payment systems).

---

Escalation in Vulnerability Management

Escalation is about passing a problem to a higher authority when it can’t be handled at the current level or requires urgent attention.

Why Escalation Matters

• Not all vulnerabilities can be fixed immediately by the first-level IT staff.
• Some require management approval, budget allocation, or specialist intervention.
• Helps ensure critical issues don’t get ignored.

Typical Escalation Process

1. Detection
   • A vulnerability is discovered through scans or monitoring tools.
2. Initial Assessment
   • IT staff evaluate the risk and severity.
   • Decide if it’s low, medium, or high priority.
3. Decision to Escalate
   • Escalate if:
     • The vulnerability is critical or high-risk.
     • The fix requires changes to core systems.
     • The issue is beyond the technical skill level of the current team.
4. Escalation Channels
   • Technical escalation: To senior IT engineers or security specialists.
   • Management escalation: To IT managers or executives for approval or resource allocation.
5. Resolution and Feedback
   • The escalated team implements the fix or mitigation.
   • Feedback is sent back to the original team, and the vulnerability is documented and closed.

---

IT Examples of Prioritization and Escalation

1. Prioritization Example
   • A web server has two vulnerabilities:
     1. An outdated plugin that can leak customer data (CVSS 9.5).
     2. A small logging bug in a test application (CVSS 3.2).
   • Action: Fix the customer data leak first because it is critical and internet-facing.
2. Escalation Example
   • A database server vulnerability requires downtime and patching, which could disrupt business operations.
   • IT staff escalate to management to approve downtime, schedule maintenance, and assign senior engineers.

---

Tips for the Exam

• Understand the difference:
  • Prioritization: Deciding what to fix first.
  • Escalation: Deciding who should handle it or approve it.
• Remember CVSS scores, impact, exposure, exploit availability, and compliance for prioritization.
• Know the steps of escalation: detection → assessment → escalation → resolution → feedback.

---

✅ Summary Table

Concept	Definition	Key Points
Prioritization	Ranking vulnerabilities by risk	Use CVSS, impact, exposure, exploits, compliance
Escalation	Passing unresolved or critical issues to higher authority	Technical or management escalation, ensures urgent issues get handled