Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / Security lead and AppSec
Security lead and AppSec: its risk register
Triage, detection, compensating controls and the call on whether an incident is declared.
Kind role · Assigned here 6 · In its register 6 · the briefing for a security lead
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R02 The coordinated disclosure broke before the fix was ready | 20 critical | Disclosure process | bearer | ISO/IEC 29147 and 30111 29147:coordination, NIS2 Art.12, NIST CSF 2.0 ID.RA-08, FIRST TLP 2.0 TLP:AMBER+STRICT |
| R03 Exploitation outpaces patching | 20 critical | Security | treater | CISA KEV and BOD 22-01 KEV-entry, CISA KEV and BOD 22-01 BOD22-01, NIST CSF 2.0 DE.CM-01, NIST SP 800-53 SI-4 +3 |
| R05 A web application firewall taken for a patch | 16 high | Security | owner | PCI DSS 6.4.2, CIS Controls 13.10, NIST SP 800-53 SC-7, ISO/IEC 27001 A.8.20 +1 |
| R03-1 Attempts before disclosure | 15 high | Security | owner | NIST CSF 2.0 ID.RA-02, ISO/IEC 27001 A.5.7, NIST SP 800-53 SI-4, PCI DSS 12.10.1 |
| R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable | 12 high | Security | owner | NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2 |
| R03-4 Detections built on a proof of concept with the wrong mechanism | 12 high | Security | owner | NIST SP 800-53 RA-5, SOC 2 CC7.1, NIST CSF 2.0 ID.RA-01 |
Where its risks sit
The standards its register touches
NIST CSF 2.0 (4), ISO/IEC 27001 (4), NIST SP 800-53 (3), CISA KEV and BOD 22-01 (2), PCI DSS (2), ISO/IEC 29147 and 30111 (1), NIS2 (1), FIRST TLP 2.0 (1), MITRE ATT&CK (1), SOC 2 (1), CIS Controls (1), Cyber Essentials (1)