Vulnerability prioritisation

# Vulnerability prioritisation

Build an explainable queue from fictional findings using a transparent local rubric and explicit evidence confidence. These are original fictional practice cases, not copied coursework or completed professional work.

## Before starting

Prerequisites: Asset discovery, access-review basics and simple addition. No CVSS calculation or vulnerability exploitation is required. Use Python 3.10+ with the standard library. Run the commands from this lab folder. The learner reads evidence, makes decisions and edits a worksheet; programming is not required.

Allow **30-45 minutes** for the first guided pass: 5 minutes for vocabulary and scope, 15 for prediction, 10 for checking and correction, and 5-15 for explanation. Changed and later recall exercises are separate practice. Personal completion and independent competence have not been assessed.

## Vocabulary

**Impact:** the supplied consequence level. **Exposure:** who can reach the affected context. **Proof of concept:** evidence a technique is possible, distinct from observed misuse. **Confidence:** whether the finding is confirmed in the fictional evidence. **Rubric:** a local decision rule, not a universal risk measure.

## Evidence and exact input model

Short findings with fictional assets, impact, exposure, exploitation evidence, critical-service status and confidence.

Each case has exactly `schema_version: 1`, `lab_id: "vulnerability-prioritisation"`, `case_id` (`guided`, `changed`, `challenge`), `title`, `synthetic: true`, `context`, `data`, `artifacts`. `context.question` is nonempty text. Objects reject unknown/missing fields; record IDs are unique lowercase names. Read the [shared file and command contract](../FOUNDATION-CONTRACT.md). Files are small UTF-8 JSON; readable artifacts are supplied through prepare where relevant.

`data.findings` records have exactly `id`, `asset` (ASCII `.test` domain), nonempty `summary`, `impact` (`low`, `moderate`, `high`), `exposure` (`internal`, `partner`, `internet`), `exploitation` (`none-observed`, `proof-of-concept`, `observed`), boolean `critical_service`, and `evidence` (`confirmed`, `unverified`). All records are synthetic and IDs are unique. `artifacts` is empty; the JSON record is the evidence source. Unknown values, missing fields and integer substitutes for booleans are rejected.

## Decision vocabulary

Calculate **impact** low=1/moderate=2/high=3 + **exposure** internal=0/partner=1/internet=2 + **exploitation** none-observed=0/proof-of-concept=1/observed=3 + **critical service** false=0/true=1.

Apply the following precedence: `investigate` for unverified evidence, regardless of score; otherwise `urgent` for observed exploitation, regardless of score; otherwise `urgent` for score 7-9, `planned` for 4-6, and `routine` for 1-3. These are queue names, not response-time promises. Within a queue the model assigns no order; explain dependencies in your written note. **This is not CVSS.** No current advisory lookup or real exploitation claim is made.

## Run the practice

Use a new attempt number if the destination already exists. Prepare writes only beneath this lab's ignored `run/` folder and refuses existing or linked paths.

```console
python lab.py cases
python lab.py prepare --scenario guided --out run/attempt-01
python lab.py show --case run/attempt-01/case.json
```

Read the case and its readable evidence. Before viewing the analysis, edit `run/attempt-01/answers.json`: replace every blank decision with an exact label above, write `explanation` as a paragraph, and put record/field/line references in the `evidence` list. Keep predictions, uncertainty, next check and help used in `notes.txt`. JSON strings use double quotes; do not add comments or trailing commas. An evidence entry can be a record ID plus the relevant field name.

```console
python lab.py check --case run/attempt-01/case.json --answers run/attempt-01/answers.json
python lab.py analyse --case run/attempt-01/case.json
python lab.py prepare --scenario changed --out run/attempt-02
python lab.py prepare --scenario challenge --out run/attempt-03
python lab.py verify
python test_lab.py
```

Repeat show/check/analyse with the new attempt path. Default case is `fixtures/guided.json` beside the script. Explicit input paths are relative to your current directory; prepare output is relative to this lab. Exit 0 means command success or matching decision fields, 1 means differences/incomplete worksheet, and 2 means invalid input or a filesystem error. Analyse shows the reference reasoning and should stay closed until a prediction is saved. Verify compares three shipped fixtures with fixed reference outputs; it does not assess a learner. Check requires prose and references but cannot judge their accuracy.

## Deliverable and handover

A prioritised queue with the arithmetic, the overriding rule if any, uncertainty, an owner question and the next evidence needed. Keep your first prediction and correction in the notes. Include an honest help-used statement. Use [the worked example](WORKED-EXAMPLE.md) for the guided case and [the drills](DRILLS.md) to reduce prompts over time.

Handover prompt: "What did you observe, which exact evidence supports it, what remains uncertain, and what narrow check should happen next?" A person should review your reasoning and an unfamiliar case before treating the practice as independently demonstrated.

## Limits and primary references

- This transparent classroom rubric is not CVSS and its scores are not probabilities or universal deadlines.
- All finding evidence and exploitation claims are supplied fiction; owners must validate evidence and agree real priorities.

Runtime is offline: no external target, packet transmission, email action or host configuration change occurs. All addresses and names are reserved fictional examples. The local decision rules are teaching choices; the references explain underlying concepts, not a claim of tool certification.

- [NIST SP 800-40 Rev. 4: patch management planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final)
- [NIST SP 800-115: assessing findings and limitations](https://csrc.nist.gov/pubs/sp/800/115/final)

# Worked example: Vulnerability prioritisation

Use this only after saving a first prediction for guided. It explains one case; matching it does not establish independent performance.

## Read, calculate, interpret

For `booking`, add impact 3, internet exposure 2, proof-of-concept 1 and critical-service 1: 7. The evidence is confirmed and the score reaches 7, so use `urgent`. For `archive`, 2 + 1 + 0 + 1 = 4, producing `planned`. For `signage`, 1 + 0 + 0 + 0 = 1, producing `routine`.

Do not rank solely by the summary wording. Write the four inputs beside each result so another learner can reproduce it. Also distinguish "none observed" from proof that exploitation has never happened. A useful handover says: "Booking enters the urgent queue under the supplied rubric at score 7; confirm the current affected configuration and agree an owner and change plan."

A score does not decide whether a specific patch is compatible or when an organisation must deploy it. Record those as further questions instead of inventing answers.

## Check and revise

Run `python lab.py check --case run/attempt-01/case.json --answers run/attempt-01/answers.json`, then reveal `python lab.py analyse --case run/attempt-01/case.json`. Compare decision fields and the reasoning. If a label differs, identify the exact missed input or rule; copying the reference label without explaining the change is not enough.

Keep a short correction in notes: "I first predicted __ because __. The evidence at __ changed that to __. I still cannot conclude __." A matching label can still have a mistaken explanation, so use the handover prompt with another person or teach it back aloud.

# Drills: Vulnerability prioritisation

## 1. Guided evidence pass

Prepare guided as `run/attempt-01`. Keep WORKED-EXAMPLE closed initially. Read the question, mark scope and evidence sources, then fill every decision and a short explanation. Use the vocabulary if needed and record that help. Allow 30-45 minutes for this first pass.

## 2. Fewer prompts

Work through these questions before opening the analysis:

- Which four supplied inputs contribute numbers?
- Which rule is evaluated before the numeric thresholds?
- What does none-observed leave uncertain?

Check decisions, read the worked example and write one correction with its evidence reference. If every label matched, still explain the hardest choice; a lucky label is not evidence of understanding.

## 3. Independent case

Prepare challenge in a fresh folder. Use challenge without notes. Explain the transitions from score 3 to 4 and why score 6 remains planned. Propose one changed input that would move exposed into urgent. Keep the reference files closed until your worksheet and handover are saved. Use the README vocabulary as a glossary if necessary and record that help. Ask another person to examine the reasoning rather than merely the exit code.

## 4. Changed conditions

Prepare changed separately and compare its evidence with guided; keep both attempts. Predict each result before revealing analysis.

- Why does a score-9 unverified rumour go to investigate?
- Why can confirmed observed exploitation produce urgent at score 4?
- What evidence would move rumour out of investigate without merely changing its label?

Write which fact changed, why the relevant rule changed or did not change, and what remains uncertain. Do not edit the shipped fixture or reference files to make an answer match.

## 5. Teach-back

Explain the rubric, its two overrides and why its numbers are neither CVSS nor probabilities. Use one record ID and a counterexample. If you need the worked example, say so in the help-used note, then try again later with it closed.

## 6. Later recall

Two days later, reproduce the thresholds and override order without the file. Construct a low-score confirmed-exploitation example and an unverified high-score example. Record the date, what you recalled unaided, what you checked and one remaining question. This is a practice record, not a claim of complete real-world competence.

## Handover

Submit your own saved worksheet and a short note answering: "What is observed, where is the evidence, what is uncertain, and what should be checked next?" Include initial prediction, correction and help used. No upload or publication is part of this lab.