Protect the control plane better than what it controls

applied · 70 min · Objective 2.6

Task

Apply objective 2.6: take the control plane of any software-defined component in your lab and bring its protection above that of the workloads it manages -- then show the gap that existed before.

Steps

  1. Write lab/control-plane.csv with header control,workloads,control_plane,gap comparing how each of authentication, network exposure, administrative access, change auditing and availability is handled for the workloads versus for the control plane.
  2. Identify every row where the control plane is protected NO BETTER than the workloads, which is the gap.
  3. Close at least two gaps for real: restrict the management interface to one source and capture a refusal from elsewhere; require brokered administrative access.
  4. Enable change auditing on the control plane and create a detection for an unexpected configuration change. Trigger it and capture the alert.
  5. Write lab/control-plane-note.md on why an attacker who reaches it does not need to touch any workload individually.

Verify

awk -F, 'NR>1 {n++} END {print n" comparison row(s)"}' lab/control-plane.csv
awk -F, 'NR>1 && $4=="yes" {n++} END {print n+0" gap(s) identified"}' lab/control-plane.csv
grep -Eic 'denied|not authorized|refused' lab/control-plane.csv lab/control-plane-note.md 2>/dev/null
grep -Ec . lab/control-plane-note.md

Five comparison rows, at least two gaps identified and closed, and a captured refusal. In most labs the control plane starts protected no better than the workloads, which is the point.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.