Enumerate subject-object-action triples for one application

short · 55 min · Objective 2.7

Task

Take one lab application and write out the relationships zero trust actually governs -- at a granularity finer than 'the application'.

Steps

  1. Create lab/zt-triples.csv with header subject,object,action,sensitivity,policy,evaluation.
  2. Decompose the application into at least four OBJECTS -- not 'the application', but its administrative function, its reporting interface, its bulk export, its individual record read.
  3. For each object, list the subjects entitled to it and the actions each may perform, separating read from write from export.
  4. Set evaluation to per-request or session for each, choosing per-request for the highest sensitivity, and state the session lifetime where it is session-scoped.
  5. Implement the distinction for at least one object: require step-up authentication or a shorter session for the most sensitive action, and demonstrate the step-up occurring.

Verify

awk -F, 'NR>1 {n++} END {print n" triple(s)"}' lab/zt-triples.csv
awk -F, 'NR>1 {print $2}' lab/zt-triples.csv | sort -u | wc -l
awk -F, 'NR>1 {print $3}' lab/zt-triples.csv | sort -u | wc -l
awk -F, 'NR>1 && $6=="per-request" {n++} END {print n+0" per-request"}' lab/zt-triples.csv

Four or more distinct objects, three or more distinct actions, and at least one per-request evaluation. An object list containing only the application name permits a policy no more precise than the network rule it replaced.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.