Order your posture signals by how forgeable they are

short · 45 min · Objective 2.5

Task

Collect every device posture signal your lab can produce, rank them by forgeability, and demonstrate that a self-reported signal can be changed by the thing reporting it.

Steps

  1. Enumerate every posture signal available into lab/posture.csv with header signal,source,hardware_rooted,forgeable_by_os,used_in_policy.
  2. Include at least six: boot measurements if available, disk encryption, protection running, patch level, management enrolment, and a self-reported agent claim.
  3. Change ONE self-reported signal on the machine so it reports a false value, and capture the management console still showing compliant in lab/posture-forged.txt.
  4. Restore the true value.
  5. Write lab/posture-note.md naming which signals survive a compromised operating system and which do not, and what that means for a posture check performed only at connection.

Verify

awk -F, 'NR>1 {n++} END {print n" signal(s)"}' lab/posture.csv
awk -F, 'NR>1 && $3=="yes" {n++} END {print n+0" hardware-rooted"}' lab/posture.csv
awk -F, 'NR>1 && $4=="yes" {n++} END {print n+0" forgeable by the OS"}' lab/posture.csv
test -s lab/posture-forged.txt && echo "forgery demonstrated"
grep -Eci 'continuous|re-evaluat|at connection' lab/posture-note.md

Six or more signals ranked, at least one demonstrably forgeable, and the note addressing continuous re-evaluation. If nothing in your list is forgeable by the operating system, you have not included a self-reported agent claim.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.