Draw the automation line and bound the weaponisable action

applied · 70 min · Objective 3.1

Task

Apply objective 3.1: classify ten response actions as automatic, gated or manual using the three principles, and put a cap on the one an attacker could trigger against you.

Steps

  1. Write lab/response-actions.csv with header action,reversible,blast_radius,signal_confidence,decision,reason.
  2. Include ten actions spanning enrichment, ticketing, indicator blocking, session revocation, account disablement, host isolation and reimaging.
  3. Set decision to automatic, gated or manual from the three principles -- reversibility, blast radius, signal confidence -- and make the reason column state which principle decided it.
  4. Identify the action an attacker could most easily TRIGGER against you by generating the signal, and implement a cap: no more than N in an hour, after which the automation escalates instead of continuing.
  5. Test the cap by generating the trigger repeatedly, and capture the escalation in lab/cap-triggered.txt.

Verify

awk -F, 'NR>1 {n++} END {print n" action(s)"}' lab/response-actions.csv
awk -F, 'NR>1 {print $5}' lab/response-actions.csv | sort | uniq -c
awk -F, 'NR>1 && $6=="" {n++} END {print n+0" with no reason"}' lab/response-actions.csv
test -s lab/cap-triggered.txt && echo "cap observed escalating"

Ten actions, all three decisions used, zero without a reason, and the cap observed firing. If every action came out automatic, re-read the lesson: if an attacker can cause the trigger, they can cause the action.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.