Move a control from detected to impossible

applied · 75 min · Objective 6.5

Task

Take one misconfiguration and walk it up the whole ladder: detect it, remediate it automatically, refuse it at creation, and finally make the compliant path the default. Each rung is stronger than the last, and most estates stop at the first.

Steps

  1. Choose one misconfiguration -- public access on a storage resource is the clearest. DETECT: write a posture check that finds it, create one deliberately, and capture the finding in lab/ladder/detect.txt.
  2. REMEDIATE: write an event-triggered action that reverts the setting automatically. Create the misconfiguration again, and record how long it existed before being corrected, in lab/ladder/remediate.md. Run it in alert-only mode first and record why that ordering matters.
  3. REFUSE AT CREATION: add a policy rule that rejects the resource outright. Attempt to create it and capture the refusal in lab/ladder/refuse.txt.
  4. REFUSE IN THE PIPELINE: add the same rule as a policy scan that fails the build before anything is created, and capture that failure too.
  5. MAKE IT THE DEFAULT: write a standard module with the safe configuration baked in, use it to create the resource, and confirm the compliant result required no decision by the user. Then rank all five rungs in lab/ladder/summary.md by strength, and note which one is the only preventive control among them.

Verify

for f in detect remediate refuse summary; do test -s lab/ladder/$f.* && echo "$f ok"; done
grep -Ec '[0-9]+ ?(s|sec|second)' lab/ladder/remediate.md
grep -Eci 'alert.only|audit mode' lab/ladder/remediate.md
grep -Eci 'default|module' lab/ladder/summary.md

All four artefacts, a measured exposure window for the automatic remediation, and the alert-only ordering recorded. Automatic remediation that fires on a legitimate change is itself an incident, which is why it is introduced in observe mode first.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.