Vulnerability › Module 7 › Lesson 3
Risk Priority
Rank confirmed findings — CVSS plus exposure plus asset value on YOUR inventory.
Visual · t18_risk_priority
Priority = severity × exposure × asset value — defender math. Original Cyberlium.
Opening
Patch the lab jump box before the scrap VM — if both are yours and both are confirmed.
After verification, prioritize confirmed findings using CVSS Base/Environmental, network exposure (internet-facing vs isolated lab VLAN), asset value from YOUR inventory, compensating controls, and exploit maturity literacy. High CVSS on disconnected scrap VM may rank below Medium on YOUR lab web server with weak auth. Build priority tiers: P1 fix this week, P2 this month, P3 accepted risk with ticket. Never publish prioritized lists of stranger infrastructure scraped from Shodan. Priority work stays on $LAB_ASSETS under RoE — reporting and remediation modules carry ranked lists forward.
1. Priority factors
Severity (CVSS adjusted), exposure (reachable from where), asset criticality tag from inventory.
Compensating control: WAF, segmentation, no sensitive data — lowers effective priority honestly.
Command guide
Try these commands — Priority factors
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Risk acceptance — https://www.cisa.gov/topics/cybersecurity-best-practices FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t18-triage.txt" <<'EOF' finding: status: true_positive|false_positive|accepted_risk verify_steps_lab_only: priority: EOF
Command — copy this
grep status "$HOME/cyberlium-lab/t18-triage.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: Risk acceptance (https://www.cisa.gov/topics/cybersecurity-best-practices); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tier labels
P1: confirmed + exposed + high impact. P2: confirmed, limited exposure. P3: low impact or FP cleared.
Document tie-breakers — same score, pick by asset owner urgency in lab scenario.
3. Scope
Priority table covers $LAB_ASSETS confirmed rows only.
No 'top ten internet vulns' blog posts from unauthorized scans — defender hygiene for owned scope.
4. What you ship: priority matrix
P1/P2/P3 definitions + five ranked confirmed findings from lab — chmod 600.
5. What you record before the next lesson
Priority matrix path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish ranked vuln list for employer prod without authorization.
Right
Name priority factors. Next: triage lab.
Mission: priority matrix draft
1) Define P1/P2/P3 for lab. 2) Rank five confirmed findings. 3) Write NEVER prioritize stranger scan dumps.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “CVSS vs risk rating — when differ?”
Knowledge Check
APPLY: Priority considers:
Multiple choice
Knowledge Check
APPLY: True or False: Shodan scrape priority list is course VA.
True or False
Knowledge Check
APPLY: Compensating controls:
Multiple choice