Chapter 24 — Controls
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Match"]
N2["24.2 Ranking lab"]
N3["24.3 Compensating"]
N4["24.4 Ownership"]
N5["24.5 Verify later"]
N6["24.6 Overclaim"]
N7["24.7 Freezing scores before discussion"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Match"]
N2["24.2 Ranking lab"]
N3["24.3 Compensating"]
N4["24.4 Ownership"]
N5["24.5 Verify later"]
N6["24.6 Overclaim"]
N7["24.7 Freezing scores before discussion"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Match]
|
v
[24.2 Ranking lab]
|
v
[24.3 Compensating]
|
v
[24.4 Ownership]
|
v
[24.5 Verify later]
|
v
[24.6 Overclaim]
|
v
[24.7 Freezing scores before discussion]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) match controls to findings; (2) rank findings; (3) propose compensating controls.
24.1 Match
Shared admin → named accounts+vault; unapproved flow → firewall+app deny; weak MFA enrolment → enrolment fix.
A control recommendation must match the weakness it answers. Shared administrator passwords are fixed by named accounts and a vault, not by a longer password policy. An unapproved network path is fixed by removing the firewall rule and denying the path in the application, not by adding monitoring alone. Weak MFA enrolment is fixed in the enrolment flow. Mismatched recommendations waste fixer time and leave the original path open. Sam's review of draft findings checks that each recommended control would actually close the demonstrated path.
24.2 Ranking lab
lab_rank orders F1,F3,F4 at score 6 before F2 at 3.
"""Lab 24: rank synthetic TRB findings by likelihood x impact, ties by id."""
f = [("F1","Shared admin on loan system",2,3),("F2","Verbose error pages",3,1),
("F3","Web tier reaches ledger DB directly",2,3),("F4","Weak MFA enrolment check",3,2)]
for i,t,l,m in sorted(f, key=lambda x:(-x[2]*x[3], x[0])):
s=l*m; print(f"{i} {s} {'high' if s>=6 else 'medium' if s>=3 else 'low':6} {t}")
Run with python3 lab_rank.py. Verified output:
F1 6 high Shared admin on loan system
F3 6 high Web tier reaches ledger DB directly
F4 6 high Weak MFA enrolment check
F2 3 medium Verbose error pages
The product of likelihood and impact is a simple ranking aid, not a law of nature. Ties break by finding id so that the order is reproducible. F1, F3 and F4 all score six and outrank F2's three, which matches the intuition that a shared admin password, a direct web-to-ledger path and a weak MFA enrolment check matter more than verbose error pages. The lab's job is to make the ranking visible before personalities enter the discussion. Once scores are on the table, arguing to demote a finding becomes a visible risk-acceptance decision rather than a quiet reordering.
24.3 Compensating
Jump-only admin while passwords uniqued.
A compensating control reduces risk while the lasting fix is unfinished. If shared admin passwords still exist, restricting administration to the jump host with multi-factor authentication shrinks who can use those passwords and makes their use auditable. Compensation is dated. The finding stays open with a due date for unique passwords, and the compensating control is listed beside it so nobody mistakes the jump-host rule for the complete fix. When the lasting fix lands, the compensation can be retired or kept as defence in depth.
24.4 Ownership
Every control has a named owner and date.
A control without an owner is a sentence in a report. The owner is the person who will implement or operate it, and the date is when it will be in place or next reviewed. TrackScope refuses to mark a finding as accepted-with-control unless both fields are filled. Ownership also prevents orphaned compensations. When the person who set up jump-only admin leaves, the dated owner field shows who must pick up the control or the finding reopens.
24.5 Verify later
Chapter 30 retests.
Declaring a control implemented is not the same as showing it works. Retests close that gap. After the owner says named accounts replaced the shared admin password, Sam schedules a retest that tries the old password and checks that administration still requires the jump host. Failed retests reopen the finding automatically. The retest date is part of the control's record, so a control that has never been retested is visible on PulseMap as unverified. A retest is planned with the same account, the same source network and the same request that proved the weakness, so a pass means the path is closed rather than that the tester tried something easier.
24.6 Overclaim
Do not call a control "prevents all APT".
Controls reduce specific paths. Naming a sophisticated actor or promising total prevention turns a precise finding into marketing. Sam's report language names the path closed, the conditions of the test and the residual risk. A sentence such as administration from the user VLAN to staging servers is blocked pending unique passwords is usable. A sentence such as this prevents advanced persistent threats is not. The assurance linter flags the second kind of phrase before the report leaves draft.
24.7 Freezing scores before discussion
Ranking meetings freeze scores before discussion of personalities. Sam collects scores silently, then reveals. Lobbying to demote a finding because a team is "busy" happens after scores, where it is visible as risk acceptance.
Silent scoring stops the first loud voice from anchoring everyone else. Revealing afterwards lets busy-ness be discussed honestly as a reason to accept risk for a time, with a signature and an expiry, rather than as a reason to pretend the finding scored lower. The difference is whether the bank's record shows the trade-off.
24.8 Written risk acceptance
Risk acceptance uses a form with amount, expiry and CISO signature. Verbal "we'll live with it" does not close F3.
Verbal acceptance evaporates when staff change or when an incident makes everyone forget who agreed. The form records what is accepted, until when and by whom. PulseMap shows accepted-with-expiry findings in amber, not green, so they do not disappear from attention. When the expiry arrives without a fix or a renewal, the finding reopens. That mechanism is the reason F3 cannot be closed with a hallway conversation.
24.9 Revealing scores only after everyone submits
Scores display only after all raters submit. Sam's facilitation script blocks early reveals.
Early reveals let later raters adjust toward the group, which defeats independent judgement. The facilitation script is a checklist Sam reads: confirm every rater has submitted, then show the table. TrackScope enforces the same rule for remote meetings by hiding the aggregate until the last ballot arrives. Blocking early reveals has occasionally delayed a meeting by five minutes and has regularly prevented a senior voice from setting the score.
24.10 A hygiene track for easy fixes
Rank reveal shows F2 last. The web team still wants F2 fixed first because it is easy. Sam records easy-but-low as a separate "hygiene" track so it does not displace F3's funding.
Easy fixes are worth doing. They are not worth starving higher-ranked work. The hygiene track has its own small capacity and its own WIP limit, so the web team can clear verbose error pages without taking engineers off the ledger-path fix. Keeping the tracks separate also keeps reporting honest: hygiene throughput is not presented as progress on high-risk findings.
24.11 Parallel tracks protect hard work
Hygiene track fixed F2 in three days without stealing the F3 budget meeting. Parallel tracks keep easy work from starving hard work.
Before the split, every easy finding competed for the same meeting slot as F3, and easy usually won because it promised a quick win. After the split, F3 kept its funding conversation and F2 still got fixed. The pattern generalises. Whenever low-severity work consistently displaces high-severity work, the fix is a separate capacity allocation, not a lecture about priorities.
24.12 WIP limits on hygiene
Hygiene track WIP limits keep it from becoming a dumping ground for ignored risk.
Without a limit, every uncomfortable finding gets relabelled as hygiene and the track becomes a second backlog of ignored risk. The limit forces a choice: finish something before starting more. Findings that do not fit must either wait, earn a place on the main ranked list or be accepted with an expiry. The WIP limit is a control on the process that claims to help. A finding moved to hygiene must still carry its original score, so anyone reviewing the track can see whether a high-risk item has been disguised as a tidy-up.
24.13 A hard WIP of three
Hygiene WIP limit is three. Fourth easy fix waits. Focus is a control.
Three is small enough that the team feels the constraint and large enough that real hygiene work continues. When a fourth easy fix appears, it waits visibly on the board. Waiting is uncomfortable and useful. It stops the quiet accumulation of half-finished tidy-ups and keeps the hygiene track's promise of speed from turning into another infinite queue. The limit is reviewed each quarter. If items wait longer than a month, the team either raises capacity or admits that some hygiene work will not be done and records that decision.
24.14 Ninety-second covers for funding boards
Funding boards receive ranked lists with a one-page plain-language cover. Sam practices the cover aloud until he can deliver it in ninety seconds. Boards remember the cover longer than the appendix.
Practising aloud catches jargon the appendix can keep and the cover cannot. Boards that remember the cover ask better questions about the ranked list. Boards that receive only the appendix often remember nothing but the total count of findings, which is the least useful number in the pack. The appendix still matters for the engineers who will do the work, so the cover always ends with a pointer to the ranked table and its scoring rubric.
Worked example (synthetic TRB)
Sam presents ranked list; board funds F1/F3/F4 first.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX070 — Rank order. Which finding ranks last in the lab? Rubric: 3 = F2; 2 = F1; 1 = F4; 0 = none.
- EX071 — Compensating. Give a compensating control for shared admin. Rubric: 3 = jump-only/MFA/monitoring while uniquing; 2 = partial; 1 = ignore; 0 = none.
- EX072 — Score. What is F4's score and band? Rubric: 3 = 6 high; 2 = 6; 1 = 3; 0 = none.
Synthesis
Controls match findings; ranking drives funding; compensating controls buy time.
Continue studying — chapter 24 of 40
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →