Observe first, then enforce, and keep the rollback

short · 60 min · Objective 2.4

Task

Put a policy point between your two lab segments in monitoring mode, collect the real flows, build the intended model from function rather than from observation, and enforce the difference.

Steps

  1. Run the policy point in ALERT-ONLY mode and collect flows for long enough to include a backup or a scheduled job. Write them to lab/flows-observed.csv.
  2. Separately, write lab/flows-intended.csv from FUNCTION and SENSITIVITY -- what should talk to what -- without looking at the observed set. Using observation as the design ratifies whatever an attacker would have exploited.
  3. Produce lab/flow-triage.csv comparing the two, classifying each difference as missing-requirement, wrong-segment or should-stop.
  4. Enforce the intended model with a default deny, and capture a blocked connection in lab/segment-deny.txt.
  5. Write lab/rollback.sh that restores the previous policy in ONE action, and test it.

Verify

awk -F, 'NR>1 {n++} END {print n" observed flow(s)"}' lab/flows-observed.csv
awk -F, 'NR>1 {n++} END {print n" intended flow(s)"}' lab/flows-intended.csv
awk -F, 'NR>1 {print $NF}' lab/flow-triage.csv | sort | uniq -c
grep -Eic 'deny|denied|blocked|dropped' lab/segment-deny.txt
sh -n lab/rollback.sh && echo "rollback script parses"

Both flow sets present, all three triage classes used, a captured deny, and a rollback script that parses. If observed and intended are identical, the intended set was written from the observed one.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.