Write the compensating control for a device that can never be patched

applied · 80 min · Objective 2.3

Task

Take an asset class that genuinely cannot be patched — an embedded device with a fifteen-year life and five years of support — and produce the full treatment: the risk statement, the controls that go around it, the monitoring that watches it, and the accepted-risk record with a review date.

Steps

  1. Nominate the stand-in device and describe it honestly in /tmp/device.md: what it does, why it cannot be replaced, what its support status is, and what happens to the business if it stops.
  2. Establish what it needs to talk to, and to what. Measure rather than assume: capture its traffic for a few minutes with tcpdump and list the actual flows.
  3. Put it on its own segment. With only two VMs, simulate this with host firewall policy: default deny both directions, then permit exactly the flows you measured and nothing else.
  4. Add monitoring: log every connection to and from it, and write a check that alerts on any flow outside the permitted set.
  5. Test the control by attempting a flow you did not permit, from the other VM you built, and confirming it is both blocked and logged.
  6. Write the accepted-risk record: the control that cannot be applied, the residual risk, the compensating controls, the owner, and the review date.

Verify

sudo nft list ruleset 2>/dev/null | grep -c 'policy drop' || sudo iptables -S | grep -c 'P INPUT DROP'
sudo grep -c "DENY\|DROP" /var/log/kern.log | tail -1
grep -icE "residual|owner|review" /tmp/device.md
grep -oE "[0-9]{4}-[0-9]{2}-[0-9]{2}" /tmp/device.md | head -1

The first must be non-zero — the default really is deny, which is what makes the permitted list meaningful. The second must be non-zero after your blocked attempt: the denial was recorded, so you would know it happened. The third must be at least three and the fourth must print a date. An unpatchable device with no review date is not an accepted risk, it is a forgotten one.

Notes

This is the pattern for every asset you cannot fix, and there are more of them than anyone likes: medical devices, building controllers, industrial controllers, the application the business runs on. The controls go around the device, the risk is recorded, and the date forces somebody to look again.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.