Mobile › Module 9 › Lesson 2
Severity and Fix
Severity and fix literacy — impact, likelihood, MASVS mapping, dev-ready remediation on $MOB_LAB findings.
Visual · t27_severity_and_fix
Severity + fix = actionable handoff. $MOB_LAB. Original Cyberlium.
Opening
Severity without a fix wastes everyone's time — tie impact to MASVS and give devs something they can ship.
Severity and fix literacy: rate impact (data exposure, account takeover category, compliance) and likelihood on $MOB_LAB context — avoid CVSS-only theater without mobile nuance; cite MASVS category for rigor; write fix with platform-specific guidance (Keychain, Keystore, remove hardcoded secret, WebView hardening); retest MASTG-ID stub. Defenders prioritize V2/V4/V5 clusters per app profile. Refused: severity inflation for drama, fixes that require illegal bypass, 'won't fix' without business justification row. Lab: upgrade Module 9-1 draft with severity rationale paragraph and fix+retest row.
1. Severity framing
Impact × likelihood in mobile context — local file read vs token exfil category different.
MASVS level (L1/L2) informs expected fix timeline — document in row.
Command guide
Try these commands — Severity framing
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CVSS v3.1 — https://www.first.org/cvss/v3.1/specification-document OWASP MASVS — https://mas.owasp.org/MASVS/ (map finding to control) MASTG test cases — https://mas.owasp.org/MASTG/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
python3 - <<'PY'
import os
lab = os.environ.get('MOB_LAB', os.path.expanduser('~/cyberlium-lab/t27-mob'))
path = os.path.join(lab, 'report', 'severity-fix-matrix.txt')
open(path, 'w').write('
'.join([
'Severity | MASVS control | Fix (YOUR lab app)',
'High | NETWORK | Enforce TLS 1.2+ in network security config',
'Medium | STORAGE | Disable allowBackup; use Keystore for secrets',
'Low | PLATFORM | Audit exported components in manifest',
'Info | RESILIENCE | Document root detection — no bypass on strangers',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'High|Medium|MASVS' "$MOB_LAB/report/severity-fix-matrix.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: CVSS v3.1 (https://www.first.org/cvss/v3.1/specification-document); OWASP MASVS (https://mas.owasp.org/MASVS/); MASTG test cases (https://mas.owasp.org/MASTG/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Fix quality
Concrete dev action + platform API + retest MASTG-ID — not 'use encryption' alone.
Link Module 7 secure coding patterns — closed loop.
3. Refused
No fixes requiring unauthorized prod access or pinning bypass on stranger apps.
No severity without evidence citation from $MOB_LAB.
4. What you ship: severity and fix addendum
Severity rationale + fix paragraph + retest MASTG-ID + no-inflation line.
5. What you record before the next lesson
Severity and fix addendum path.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark informational log typo as Critical without evidence to 'practice severity.'
Right
Severity and fix addendum on $MOB_LAB finding. Next: Responsible Scope.
Mission: severity and fix addendum
1) Write severity rationale for one finding. 2) Platform-specific fix paragraph. 3) Retest MASTG-ID stub. 4) Write NEVER severity inflation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Local file read — typical severity band?”
Knowledge Check
APPLY: Severity should cite:
Multiple choice
Knowledge Check
APPLY: True or False: Critical severity without evidence is acceptable.
True or False
Knowledge Check
APPLY: Fix handoff includes:
Multiple choice