Severity and Fix

Severity and fix literacy — impact, likelihood, MASVS mapping, dev-ready remediation on $MOB_LAB findings.

Severity and Fix• Audio Walkthrough

00:00/02:58

Visual · t27_severity_and_fix

Severity + fix = actionable handoff. $MOB_LAB. Original Cyberlium.

Severity without a fix wastes everyone's time — tie impact to MASVS and give devs something they can ship.

Severity and fix literacy: rate impact (data exposure, account takeover category, compliance) and likelihood on $MOB_LAB context — avoid CVSS-only theater without mobile nuance; cite MASVS category for rigor; write fix with platform-specific guidance (Keychain, Keystore, remove hardcoded secret, WebView hardening); retest MASTG-ID stub. Defenders prioritize V2/V4/V5 clusters per app profile. Refused: severity inflation for drama, fixes that require illegal bypass, 'won't fix' without business justification row. Lab: upgrade Module 9-1 draft with severity rationale paragraph and fix+retest row.

1. Severity framing

Impact × likelihood in mobile context — local file read vs token exfil category different.

MASVS level (L1/L2) informs expected fix timeline — document in row.

Command guide

Try these commands — Severity framing

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

CVSS v3.1 — https://www.first.org/cvss/v3.1/specification-document OWASP MASVS — https://mas.owasp.org/MASVS/ (map finding to control) MASTG test cases — https://mas.owasp.org/MASTG/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
python3 - <<'PY'
import os
lab = os.environ.get('MOB_LAB', os.path.expanduser('~/cyberlium-lab/t27-mob'))
path = os.path.join(lab, 'report', 'severity-fix-matrix.txt')
open(path, 'w').write('
'.join([
  'Severity | MASVS control | Fix (YOUR lab app)',
  'High     | NETWORK       | Enforce TLS 1.2+ in network security config',
  'Medium   | STORAGE       | Disable allowBackup; use Keystore for secrets',
  'Low      | PLATFORM      | Audit exported components in manifest',
  'Info     | RESILIENCE    | Document root detection — no bypass on strangers',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'High|Medium|MASVS' "$MOB_LAB/report/severity-fix-matrix.txt"

Primary tools to practice this lesson: python3, grep. Reference sites: CVSS v3.1 (https://www.first.org/cvss/v3.1/specification-document); OWASP MASVS (https://mas.owasp.org/MASVS/); MASTG test cases (https://mas.owasp.org/MASTG/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Fix quality

Concrete dev action + platform API + retest MASTG-ID — not 'use encryption' alone.

Link Module 7 secure coding patterns — closed loop.

3. Refused

No fixes requiring unauthorized prod access or pinning bypass on stranger apps.

No severity without evidence citation from $MOB_LAB.

4. What you ship: severity and fix addendum

Severity rationale + fix paragraph + retest MASTG-ID + no-inflation line.

5. What you record before the next lesson

Severity and fix addendum path.

6. Wrong vs right: stranger phones vs lab emulator apps

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Mark informational log typo as Critical without evidence to 'practice severity.'
Right: Severity and fix addendum on $MOB_LAB finding. Next: Responsible Scope.

Hands-on Exercise