A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?

When an audit reveals numerous vulnerabilities across multiple applications, a risk-based approach to remediation is the standard and most effective strategy. Not all vulnerabilities pose the same level of threat. Therefore, the engineer should recommend fixing the applications by prioritizing them based on their calculated risk scores. A risk score typically considers the vulnerability's severity (e.g., CVSS score), the business criticality of the application, the sensitivity of the data it processes, and its exposure (e.g., internal vs. internet-facing). This ensures that the most critical issues are addressed first, optimizing the use of remediation resources.

A. Identifying the business applications is a prerequisite step for risk scoring and should have already been completed during the audit or asset inventory phase.
B. CSRF is a code-level vulnerability within the application itself, not typically in third-party software. Patching requires code changes, not just updating a library.
C. Validating the vulnerability with exploits is part of the assessment phase to confirm findings, not a recommendation for the patching or remediation phase.

1. National Institute of Standards and Technology (NIST), "SP 800-30 Rev. 1, Guide for Conducting Risk Assessments," Section 3.3, "Vulnerability Identification." The guide emphasizes that after identifying vulnerabilities, risk assessment is used to prioritize response actions.

2. OWASP Foundation, "OWASP Risk Rating Methodology." This methodology provides a framework for calculating risk scores based on likelihood and impact factors, which is then used to prioritize remediation efforts.

3. Cisco, "A Framework for Security Vulnerability Management," White Paper. This document describes a vulnerability management lifecycle where prioritization, based on risk to the business, is a critical step between vulnerability discovery and remediation.