A security analyst is preparing a vulnerability report for a cloud-based application. The report needs to clearly articulate the business risk associated with a newly discovered SQL injection vulnerability to the application development team. Which of the following details, in addition to the technical description, would be MOST impactful for this audience?
- AThe average time it takes for the development team to fix critical bugs.
- BA list of all other vulnerabilities found in the same application.
- CA comparison of this vulnerability's CVSS score to other applications.
- DThe potential impact on customer data privacy and regulatory non-compliance.
Show answer & explanationAnswer & explanation
Correct answer: D. The potential impact on customer data privacy and regulatory non-compliance.
The application development team needs to understand the business implications of the vulnerability to prioritize its remediation. The potential impact on customer data privacy and regulatory non-compliance (e.g., GDPR, HIPAA) directly relates to the negative consequences of their code, motivating them to act. Technical details are already understood, and comparative metrics (A, C, D) are less impactful than direct business risk.
Why the other options are wrong
- A. This is an internal team performance metric, not a description of the vulnerability's business impact.
- B. While useful for overall context, it doesn't highlight the specific business risk of *this* SQL injection to the development team.
- C. Comparing CVSS scores to other applications is less impactful than detailing the direct business risk this specific vulnerability poses.
Dev Team Vulnerability Communication
Communicating vulnerability details to development teams, emphasizing technical specifics and the direct impact on their application's functionality, data, and compliance.
- Provide actionable technical details for remediation.
- Explain the exploitability and potential consequences.
- Highlight impact on data, user experience, and regulatory compliance.
Memory trick: Developers need to know how their CODE affects customers and COMPLIANCE.