Harden one environment end to end and prove each control

capstone · 150 min · Objective 4.5

Task

Pull the whole Security domain together on a single environment: identity, image, runtime, network, encryption and evidence -- with every control demonstrated by a test that FAILS when the control is removed.

Steps

  1. Produce lab/cap4/baseline.md: run a posture assessment against the environment as it stands and record every finding, with the query that produced it.
  2. Harden identity and images: least-privilege policies built from denials, an explicit deny protecting logging, signed images with enforced verification, and image scanning gating the build. Record each control and the test that proves it in lab/cap4/controls.csv with columns control,how_enforced,proof_command,removal_test_result.
  3. Harden runtime and network: non-root, read-only root filesystem, dropped capabilities, resource limits, default-deny ingress and egress with DNS re-added, and the metadata address blocked from workloads.
  4. Harden data: encryption at rest with a key you control, enforced TLS in transit including between internal services, and secrets fetched at run time by workload identity with none in any image or environment.
  5. For EVERY control, remove it, re-run its proof command, and confirm the test now fails -- then restore it. Finish with a second posture assessment compared against the baseline, and lab/cap4/evidence.md mapping each control to the CV0-004 objective it satisfies.

Verify

for f in baseline controls evidence; do test -s lab/cap4/$f.* && echo "$f ok"; done
awk -F, 'NR>1 && NF>=4 {n++} END {print n" control(s) with a removal test"}' lab/cap4/controls.csv
awk -F, 'NR>1 && tolower($4) ~ /fail|denied|blocked/ {n++} END {print n" proven by removal"}' lab/cap4/controls.csv
grep -Ec '4\.[1-5]' lab/cap4/evidence.md

At least ten controls, each with a removal test that FAILED when the control was absent, and every objective from 4.1 to 4.5 represented. A control whose test passes with the control removed is not testing the control.

Notes

The removal test is the entire design of this capstone. It is the same standing rule as every canary in this repository: a check that has only ever passed has not been shown to detect anything, and a security control is exactly the kind of thing that must be shown.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.