Secure one machine end to end and write the evidence that it is secured

capstone · 90 min · Objective 2.2

Task

Take the disposable guest from a default installation to a defensible configuration across every objective in this domain, and produce the evidence document -- each control, how it is configured, and the check that proves it. This is the domain's capstone because the evidence is the deliverable: a claim that a machine is hardened, with no check behind it, is the thing this whole library exists to refuse.

Steps

  1. Build the baseline and record it in lab/secure/baseline.csv with header control,default_state,target_state covering accounts, authentication, encryption, permissions, update policy, endpoint protection, browser configuration and remote access.
  2. Implement every target state, recording exactly what you configured in lab/secure/implemented.csv with header control,configuration,where_set.
  3. For each control, write a check that would fail if it were undone, in lab/secure/checks.csv with header control,check_command_or_observation,expected_result.
  4. Run every check and record the result in lab/secure/results.csv with header control,result,pass. Then deliberately undo two controls, re-run, and confirm those two checks fail.
  5. Write lab/secure/evidence.md as the document you would hand to someone asking whether this machine is secured: what was done, how it is verified, what is still open, and what was deliberately not done and why.

Verify

awk -F, 'NR>1 && NF>=3 {n++} END {print n" control(s) in the baseline"}' lab/secure/baseline.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" control(s) implemented"}' lab/secure/implemented.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" check(s) written"}' lab/secure/checks.csv
awk -F, 'NR>1 && $3 ~ /no|fail/ {n++} END {print n" check(s) proven able to fail"}' lab/secure/results.csv
grep -Eic 'still open|not done|deliberately' lab/secure/evidence.md

Eight controls with a check each, and at least two checks proven able to fail by undoing the control. A set of checks that all pass and have never failed is a set of checks nobody has shown can detect anything -- which is the single principle this course is built on.

Notes

The "deliberately not done" section of the evidence document is the part that makes it trustworthy. A hardening report with no omissions listed is a report nobody has thought carefully about.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.