Chapter 17 — Laboratory: compare containment and restoration options
Lesson map
Lesson 17 published. Map, example, EX065.
flowchart TD
N0["Learning outcomes and connection"]
N1["17.1 Define acceptance before selecting a control"]
N2["17.2 Side-by-side classroom measurements"]
N3["17.3 Reproducible gate and negative variant"]
N4["17.4 Decision record and restoration boundary"]
N5["Subject synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX065"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["17.1 Define acceptance before selecting a control"]
N2["17.2 Side-by-side classroom measurements"]
N3["17.3 Reproducible gate and negative variant"]
N4["17.4 Decision record and restoration boundary"]
N5["Subject synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX065"]
[Learning outcomes and connection]
|
v
[17.1 Define acceptance before selecting a control]
|
v
[17.2 Side-by-side classroom measurements]
|
v
[17.3 Reproducible gate and negative variant]
|
v
[17.4 Decision record and restoration boundary]
|
v
[Subject synthesis]
|
v
[Worked example] --> [Exercise EX065]
Learning outcomes and connection
The learner will compare two containment choices and one isolated restoration candidate against explicit security, service, evidence and rollback tests. Chapter 16 supplied the approval and stop-state contract. Here the learner must measure a candidate against that contract without turning a paper simulation into a claim that a production system was secured. The case still lacks proof of an unauthorized committed R42 write. NIST SP 800-184 is a recovery-planning and testing reference; the exact K17 service outcomes are original fictional fixtures.
17.1 Define acceptance before selecting a control
The K17 classroom service contract has four outcomes. Security: no new unauthorized R42 write in the bounded test window, established from the authoritative database and route evidence rather than a gateway response alone. Legitimate work: approved R40 and R41 operations reach the intended authoritative state, including queued retry behavior. User experience: a patron can read correct reservation state, not merely load a static page. Audit: raw source and control-change records remain available, with the same collection limitations documented. The exercise also requires a prior-state control version and a named rollback owner. A candidate failing one mandatory service outcome cannot be rescued by a high average score.
These are test specifications, not facts about LLR. K10's offline predicate showed a targeted deny could leave read access and another route intact. K12/K13 showed a queued application event and an IdP denial under a different session. K14/K15 did not resolve the DB outcome. Accordingly the trigger for any real containment remains conditional: a source-validated continuing harmful action plus incident-lead and affected-owner approval. If an organization instead faces a demonstrably urgent safety risk, its authorized decision makers can choose a broader measure; this teaching packet does not grant that authority.
Option A: targeted temporary write restriction. Scope to a validated session and write route, with expiry. A laboratory policy match could deny sess-K9 while preserving sess-W1 and sess-P1. Its strengths are reversibility and potentially smaller service effect. Its failure modes are incomplete session mapping, bypass through another route, remaining read capability and policy evaluation at a different enforcement point. Tests must cover the actual write path and an authoritative R42 state query, plus legitimate R40/R41 and patron read. A policy log alone proves only a policy decision.
Option B: broad svc-book revocation. This may cover multiple sessions but could stop the legitimate worker and application. A quick portal health check is not sufficient: the worker could be unable to finish R40 while the static site stays green. Revocation can also complicate evidence preservation, job replay and rollback. A broad option may be appropriate under a different validated threat and owner decision, but in this simulated candidate its business acceptance fails. Record precisely which check failed rather than labeling the option “bad” in all circumstances.
Option C: isolated restore rehearsal. Use a versioned, verified snapshot in a disconnected test environment, then compare R40/R41 state, R42 state, audit continuity and patron query correctness against owner-approved expectations. A matching digest says the candidate bytes match a recorded copy; it does not prove that the copy is clean, recent or business-correct. The recovery point must be evaluated against later legitimate changes. An isolated test that passes has not performed production restoration. The DB owner and service owner still need a cutover and reconciliation plan, authority, rollback and acceptance evidence. Never erase the affected source in order to “restore” a lab result. Recovery after an incident is an operational decision with data-loss and integrity consequences.
17.2 Side-by-side classroom measurements
The table is a fictional simulation, released only for this lab. “Receipt” means an authoritative classroom DB result supplied in the K17 card, not a real database export. A test outcome marked unknown is not a pass.
| Candidate | R42 new write test | R40/R41 correct | Patron read correct | Audit continuity | Interpretation |
|---|---|---|---|---|---|
| A targeted rule | Toy policy says deny; DB receipt missing | Simulated pass | Simulated pass | Simulated pass | HOLD: security outcome has no authoritative result; validate route/DB receipt. |
| B broad revoke | Simulated no new write | Fail: R40 worker stops | Simulated pass | Simulated pass | FAIL mandatory business acceptance; consider rollback or a separately approved emergency exception. |
| C isolated restore | Lab DB check shows no new R42 | Lab R40/R41 reconciliation passes | Lab patron query passes | Lab manifest passes | LAB PASS only; production cutover and post-restore state remain untested. |
Why is A not a pass? “No DB receipt” is an unknown, even when the policy simulator denies a request. Why is C not a completed recovery? The test environment lacks live queues, current accepted transactions, real traffic, production identities and cutover timing. Why not assign a weighted score? A weighted score can conceal a failed mandatory test. Use hard gates first, then compare costs and residual risks among candidates that meet them.
17.3 Reproducible gate and negative variant
The Python 3 listing prints the table's gate outcomes. Its strings describe a simulation; no service is contacted. A variant copies A and sets its DB receipt to True and its R42 result to False, the two values A was missing. That raises A to LAB_PASS, but still says nothing about real authorization or deployment.
candidates = {
"A_targeted": {"db_receipt": False, "r42_new": None,
"r40_r41": True, "patron": True, "audit": True},
"B_broad": {"db_receipt": True, "r42_new": False,
"r40_r41": False, "patron": True, "audit": True},
"C_isolated_restore": {"db_receipt": True, "r42_new": False,
"r40_r41": True, "patron": True, "audit": True},
}
def gate(record):
if not all(record[k] for k in ("r40_r41", "patron", "audit")):
return "FAIL_SERVICE_OR_AUDIT"
if not record["db_receipt"] or record["r42_new"] is None:
return "HOLD_SECURITY_EVIDENCE"
if record["r42_new"]:
return "FAIL_SECURITY"
return "LAB_PASS_PRODUCTION_UNPROVEN"
for name, record in candidates.items():
print(name + ":", gate(record))
variant = dict(candidates["A_targeted"], db_receipt=True, r42_new=False)
print("A_variant:", gate(variant))
The order of checks is intentional: a service or audit failure stops a candidate even if the security flag looks good. If the r42_new value were True with other gates passing, FAIL_SECURITY would result. A malicious or mistaken test fixture could still lie; real acceptance requires independently sourced evidence, verified query coverage and owner sign-off. A negative test can expose an error, but a small set of passing tests never proves universal containment.
17.4 Decision record and restoration boundary
A technical decision record should include candidate version, trigger evidence, system/service owners, approved scope, pre-change baseline, lab observations, real-source evidence gaps, operator, stop conditions, rollback procedure and next review time. For this K17 packet the recommended current state is HOLD: continue bounded, authorized collection and service verification; do not claim any option has been deployed. If a future owner supplies a source-linked continuing harmful write and validates the route, A can be considered with a time-limited approval and the four mandatory checks. If A fails, stop or roll back under the written control contract and preserve the failure evidence. B's failed R40 result demands escalation before any broader measure. C may inform a recovery plan but is not permission for a production cutover.
The work is not finished when a rule is removed or a snapshot boots. The worker's queued tasks might retry, R40/R41 might need reconciliation, and customer-visible state might differ from DB rows because of cache or index delay. Assign these to named owners and require positive and negative controls. A service that is reachable can still be incorrect. Recovery documentation should retain what was observed, what was inferred, what action actually occurred and which risks remain.
Exercises — subject 17
EX065 — Gate transcript. Run §17.3 and record all four output lines. Change A's receipt to True but leave r42_new as None in a second copy and explain why it remains on HOLD. Evidence: three transcripts and a gate explanation. Rubric: 2 = exact gate order and unknown handling, 1 = labels without mechanism, 0 = calls A production-safe.
EX066 — Two-containment comparison. For A and B, write a control contract with trigger, scope, expiry, owner, R42/R40/R41/read/audit tests, stop condition and rollback. Identify a bypass test for A and the observed service regression for B. Evidence: paired comparison. Rubric: 2 = security plus business checks and residual risk, 1 = one-sided comparison, 0 = ignores the R40 failure.
EX067 — Isolated restore assessment. Given the C lab pass, design a pre-cutover checklist for snapshot provenance, age, digest, R40/R41 reconciliation, R42 state, queue replay, patron read and rollback. Name the owner of each sign-off and one reason a byte-perfect copy might be the wrong restore point. Evidence: restore decision card. Rubric: 2 = integrity and business correctness distinguished, 1 = digest only plus one service check, 0 = announces production recovery.
EX068 — Decision under a new finding. A hypothetical owner-validated source now shows continuing harmful R42 writes through a route not covered by A. Revise the decision record without rewriting the earlier K17 packet. Explain whether A's lab result still addresses the route, whether B can be used despite R40 failure, and the next owner-approved test. Evidence: v1/v2 decision note. Rubric: 2 = new route, authority and service tradeoff, 1 = recommends control without falsifier, 0 = assumes the current lab packet approved a change.
Subject synthesis
K17 makes the test outcomes and unknowns comparable while refusing to score away a mandatory failure. A hold, a lab pass and a production-verification result are different states. Chapter 18 asks the learner to build a supervised case dossier from staged evidence and hand it to a new operator.
Continue studying — chapter 17 of 18
← Chapter 16 · Course chapter index · Chapter 18 →
Continue to the next authored lesson.