Is there any reference material out there for the severity of standard software security findings? E.g SQL Injection is severity 1, Missing header is severity 4?

I understand risk assessment depends on many factors and environmental differences, but is there still a rough guide that can be followed?

My software firm regularly gets complaints from a single client who conduct cheap Penetration Testing every time they take a patch. They refuse to pay bills, and take the software offline until we address the problems as the penetration testing firm raises Informative type findings as "High Risk". The most severe risk they identified was that a CSS file was visible in source, yet they had no evidence to support if it was exploitable. Their justification was source code should not be visible.

How can I defend this and try to bring it to the clients interests as well as ours that these Penetration Testers are duds?


Establish your own standard of risk ranking, and get your client to agree to it.

Start by assessing the risk that the app poses to the organization. For example, if the system handles any regulated data (PCI, HIPAA, GLBA, PHI, PII, etc.), or if it is externally facing, or if it is mission critical, call it a high risk system, and anything the pen testers find will be classified as a high risk finding that must be addressed immediately. But if it's not a high risk system, then only demonstrably exploitable findings will be considered high severity vulnerabilities that require immediate remediation. Perhaps you can further identify a class of "very low" risk applications that can be exempt from costly pen testing.

Your clients only have so many security dollars to spend. It's your responsibility to help them spend them where they have the best chance of producing meaningful results.

  • It is definitely a good point to raise. Generally though if I was in the shoes of the client (and knew nothing of security or how software worked) I would tend to lean towards the view of the independent review over the view from the vendor, otherwise why hire them if you don't trust them. That's why I was hoping there was some form of community view or backing on severity to leverage my recommendation from. – Cyassin Aug 9 '17 at 2:29

I don't know of any framework that you can implement yourself that is on the one hand so broad, that it touches every possible security issue that might come up in a penetration test and is on the other hand so specific, that it provides an exact scoring system.

I understand risk assessment depends on many factors and environmental differences, but is there still a rough guide that can be followed?

There is at least one more important factor to look at, and that is the organisations "appetite for risk". A specific risk is a "High Risk" for one organisation, and a "Medium Risk" for another. If your company tends to make high risk business decisions on a regular basis, they might accept risks that others just wont.

Your given example was a visible CSS file. It seems that you would say: "Hey, as long as it is not exploitable now, what's the harm? That's not a high risk!". The reasoning behind their justification is (maybe): "It may be not exploitable now, but we don't want source code to be visible, so attackers don't get ideas on HOW to exploit it in the future." (Which is a reasoning I support to be honest.)

IMHO, there are two things you can do.

  1. Coming from a methodical viewpoint, use the Common Vulnerability Scoring System (CVSS) and compare their findings to vulnerabilities in vulnerability databases that are publicy available, like this one. (Search Sec.SE for a lot of questions on this topic.) This will give you an idea on how serious a vulnerability is and also will lead you to a better evaluation of the findings of the penetration tests.

  2. Coming from a business viewpoint, get in touch with the penetration testers and ask questions. Challenge their findings and find out what the reasoning behind their assessment is. If you get the feeling, that every identified risk ends up being a "High Risk", suggest another penetration tester to your client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.