Course capstone: make every claim in the lab prove itself

capstone · 180 min · Objective 4.4

Task

The last exercise of the course. Run every proof this lab has built, in one sequence, and produce a single register in which no control is recorded as working unless it has been observed both working and refusing -- which is the argument the whole course has been making.

Steps

  1. Write lab/master-runner.sh invoking, in order: lab/expire-exceptions.sh and lab/raci-check.sh from domain 1, lab/boundary-runner.sh from domain 2, lab/engineering-runner.sh from domain 3, and the detection triggers and pipeline checks from domain 4. It must exit non-zero if ANY of them does.
  2. Write lab/claims.csv with header domain,claim,proof,observed_working,observed_refusing,measured_on,stale_after covering at least twenty claims across the four domains.
  3. Fill every row from a real run. Any claim you cannot demonstrate REFUSING goes in lab/undemonstrated.md with what it would take -- that file is the honest output of the whole course.
  4. Run the master runner and capture the output. Then break one control in each domain, run again, and confirm it goes non-zero each time and names the right one.
  5. Write lab/final-report.md in two pages for an executive audience: risk against appetite, obligations and status, the measurements with their dates and staleness, the decisions required, and the undemonstrated claims stated plainly as what you do not know.
  6. Write lab/what-i-would-do-next.md -- the three things you would do first with a budget, each justified by a number from your own lab rather than by a preference.

Verify

sh lab/master-runner.sh; echo "master exit=$?"
awk -F, 'NR>1 {n++} END {print n" claim(s)"}' lab/claims.csv
awk -F, 'NR>1 && ($4=="" || $5=="") {n++} END {print n+0" without both states"}' lab/claims.csv
awk -F, 'NR>1 {print $1}' lab/claims.csv | sort -u | wc -l
awk -F, 'NR>1 && $7=="" {n++} END {print n+0" with no staleness date"}' lab/claims.csv
grep -Ec . lab/undemonstrated.md
grep -Eci 'appetite|obligation|decision|do not know' lab/final-report.md

Twenty or more claims across all four domains, every one carrying both observed states and a staleness date, the master runner exiting 0 on a healthy lab and non-zero for each deliberate break, and the undemonstrated file non-empty and named in the report. A claim with no proof, no failure observation and no staleness date is a belief with a document attached -- and knowing the difference is what this level is.

Notes

lab/undemonstrated.md being non-empty is not a failure of the exercise. Every real programme has that list; almost none writes it down, which is why it surfaces as a surprise during an incident instead of as a line in a report. Finishing this course with an honest one is the most transferable thing in it.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.