A city VA report lists hundreds of low-severity findings and buries one critical default credential on an internet-facing admin portal. How should prioritization work?
Select an answer to reveal the explanation.
Short Explanation
A pile of paper cuts does not outrank an unlocked front door. Fix what an attacker would actually use first—like that default admin password—then grind through the noise.
Full Explanation
When a city VA report lists hundreds of low-severity findings but buries one critical default credential on an internet-facing admin portal, prioritization should follow realistic exploitability and business impact, elevating the default credential ahead of bulk lows. Sorting purely by finding count so the largest pile of lows is fixed first mismanages scarce municipal effort. Discarding all lows automatically while never mentioning the credential until retest is negligent. Averaging CVSS into one number and remediating only if the average exceeds 7.0 hides critical outliers. Exam caveat: internet-facing authentication weaknesses often dominate risk even when rare. Operational check: create a priority queue headed by the default-credential portal issue, assign an owner, validate fix with a controlled retest, then schedule batches of lows by exposure and asset criticality. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.