Deny an exfiltration to your own second account

short · 55 min · Objective 2.5

Task

Implement the claim most estates omit -- my identities may only access trusted resources -- and prove it by attempting to write data to an account outside your organisation.

Steps

  1. Before the control, write a test object from a lab workload to the external destination and capture the SUCCESS in lab/perimeter-before.txt.
  2. Apply an identity-side policy restricting which resources your principals may reach, and a resource-side policy restricting which principals may reach yours.
  3. Attempt the external write again and capture the refusal in lab/perimeter-deny.txt.
  4. Attempt to reach one of YOUR resources using a credential from outside the expected network, and capture that refusal too.
  5. Add one enumerated exception for a legitimate external destination, and confirm the exception works while everything else stays denied.

Verify

test -s lab/perimeter-before.txt && echo "baseline success captured"
grep -Eic 'denied|not authorized|explicit deny' lab/perimeter-deny.txt
grep -c . lab/perimeter-deny.txt

A baseline SUCCESS before the control and two distinct refusals after it. The before-capture is what distinguishes a working perimeter from an operation that never worked anyway.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.