Review an architecture for what a scanner cannot see

applied · 75 min · Objective 1.9

Task

Apply objective 1.9: conduct an architecture review of your lab against the six questions a scanner cannot ask, and produce findings that no vulnerability tool would have reported.

Steps

  1. Run a vulnerability scan of the lab and save the findings to lab/scan-findings.txt.
  2. Conduct the review, answering in lab/arch-review.md: where does trust change and is the change enforced; is authority proportionate; what is the blast radius of each component; are controls placed where they can be enforced; can this be operated; what happens when a component fails.
  3. Record each review finding in lab/arch-findings.csv as finding,question,property,in_scan_output,remediation.
  4. Set in_scan_output to yes or no by actually searching the scan file. At least three findings must be no.
  5. Fix one design finding for real -- narrow an over-broad identity, move a control to where it is enforceable -- and record what changed.

Verify

awk -F, 'NR>1 {n++} END {print n" review finding(s)"}' lab/arch-findings.csv
awk -F, 'NR>1 && $4=="no" {n++} END {print n+0" invisible to the scanner"}' lab/arch-findings.csv
awk -F, 'NR>1 {print $2}' lab/arch-findings.csv | sort -u | wc -l
grep -Eci 'blast radius|fail|authority|boundary' lab/arch-review.md

Five or more findings, at least three invisible to the scanner, and at least four of the six questions represented. If every finding also appears in the scan output, you have run a second scan rather than a review.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.