Show a control exists, then show it operates

short · 50 min · Objective 2.4

Task

Take five controls you believe your lab has, and for each produce evidence that it is operating -- not that it is configured. The two look identical from outside, and the difference is the whole of control assurance.

Steps

  1. List five controls your lab has: log collection, an endpoint agent, a host firewall, account lockout, and backups of the collector's data.
  2. For each, write the existence evidence: the configuration, the console, the policy. This is what most audits accept.
  3. Now write the operating evidence, which must be a measurement with a date: what fraction of hosts actually report, whether the agent is running on every host in your independent inventory, whether the firewall is dropping anything, whether lockout triggers when you test it, and whether a restore has been performed.
  4. Test each one. Actually lock an account out. Actually restore a backup. Actually check agent coverage against the discovery lab's host list rather than against the agent console's own list.
  5. Classify each control: operating, partially operating with a measured gap, or existing only.
  6. For each gap, write it as a finding with its evidence, and map it to a control family -- preventive or detective, technical or administrative.

Verify

comm -23 /tmp/active.txt /tmp/agents.txt | wc -l
for i in $(seq 1 6); do ssh nosuchuser@10.10.10.10 true 2>/dev/null; done; grep -c "authentication failure" /var/log/auth.log
sudo iptables -L INPUT -n -v | awk '/DROP/{s+=$1} END{print s+0}'
tar -tzf /tmp/collector-backup.tar.gz | wc -l
find /var/log/collected -type f -mmin -30 | wc -l

The first is agent coverage measured against an independent denominator, and it is the only version of that number worth reporting. The lockout test, the firewall drop counter and the backup listing are each an operating measurement rather than a configuration reading. The last confirms collection is live right now, not merely enabled.

Notes

The pattern to carry: for every control, ask what number, with a date, would distinguish it working from it merely existing. If no such number exists, the control is an assertion.

MFA enabled with 340 exclusions, logging configured on a source that stopped six weeks ago, backups that run and have never been restored -- all three appear compliant in every document and fail in the only test that counts.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.