Build a zone and find the path out that you did not design

applied · 80 min · Objective 2.5

Task

Apply objective 2.5: build a secure zone answering all four questions, then hunt for the egress path nobody designed -- which is what a real zone's weakest link usually is.

Steps

  1. Write lab/zone-design.md answering all four: what enters, what leaves, what is logged, what is denied by default. Enumerate every permitted flow by name.
  2. Implement it, with default deny on ingress, egress AND east-west inside the zone, and logs shipped OUTSIDE the zone.
  3. Now hunt for undesigned egress: software updates, package downloads, DNS resolution, telemetry, a monitoring agent's outbound channel, a backup destination. Record every one found in lab/zone-egress.csv as path,designed,purpose,decision.
  4. For each undesigned path, either enumerate it as an exception with a control, or close it. Capture one closure as a refusal.
  5. Verify the logs cannot be altered from inside the zone: attempt it and capture the refusal.

Verify

grep -Eci 'enters|leaves|logged|denied by default' lab/zone-design.md
awk -F, 'NR>1 {n++} END {print n" egress path(s) found"}' lab/zone-egress.csv
awk -F, 'NR>1 && $2=="no" {n++} END {print n+0" undesigned"}' lab/zone-egress.csv
grep -Eic 'denied|read-only|not authorized' lab/zone-egress.csv lab/zone-design.md 2>/dev/null

All four questions answered, three or more egress paths found, and at least two of them UNDESIGNED. A zone where every egress path was designed has not been hunted properly -- DNS and update channels exist in every environment.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.