Draw the container estate and name what each compromise gives

applied · 75 min · Objective 2.1

Task

Apply objective 2.1: map registry, pipeline, control plane, nodes, workloads and identities, and for each component state what compromising it yields and which control bounds that.

Steps

  1. Write lab/container-estate.md enumerating every component and the trust relationships between them.
  2. Create lab/compromise-map.csv with header component,attacker_gains,bounding_control,implemented,evidence.
  3. Include at least eight components, and for each name concretely what an attacker gains -- 'the cluster' is not an answer, 'the ability to schedule a pod on any node with any service account' is.
  4. Implement one bounding control that is currently missing, and capture its evidence.
  5. Identify the component whose compromise has the LARGEST blast radius and write one paragraph on why it is usually protected less well than the workloads it runs.

Verify

awk -F, 'NR>1 {n++} END {print n" component(s)"}' lab/compromise-map.csv
awk -F, 'NR>1 && $4=="yes" && $5=="" {n++} END {print n+0" claimed without evidence"}' lab/compromise-map.csv
grep -Eci 'control plane|api server|registry|pipeline' lab/container-estate.md
grep -Eci 'blast radius|largest' lab/compromise-map.csv lab/container-estate.md 2>/dev/null

Eight or more components, ZERO controls claimed without evidence, and the control plane identified as the largest blast radius. If a workload came out largest, re-read the lesson.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.