Failure Domains
Compensating controls literacy names primary control gaps, alternative mitigations, risk acceptance linkage, and review cadence — document compensating row on YOUR $ARCH_LAB when primary control cannot deploy.
Visual · t41_compensating_controls
Compensating controls literacy. $ARCH_LAB only. Original Cyberlium.
Primary control missing is not silent gap — literacy teaches compensating control documentation so fictional org decisions on $ARCH_LAB stay defensible under architecture review.
When a primary control cannot be implemented — legacy system, vendor limitation, migration window — compensating controls reduce risk through alternative means: enhanced monitoring, network isolation, manual review procedures. Each compensating control needs gap description, alternative control, residual risk note, owner, and expiry on YOUR lab template. Cyberlium writes compensating row on YOUR $ARCH_LAB — primary gap, compensating control, owner, review date for one fictional LAB-ARCH-001 system. Next: Defense Lab.
1. Compensating control fields (named)
Primary gap: which control cannot deploy on YOUR fictional system. Compensating: alternative mitigation — enhanced logging, jump host, read-only access. Residual: risk level after compensating control. Owner and expiry: who maintains and when primary control replaces compensating.
On $ARCH_LAB, write compensating row — gap, alternative, owner, review date for one fictional scenario.
Command guide
Try these commands — Compensating control fields (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: OWASP Threat Modeling (https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html); Microsoft SDL trust boundaries (https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why compensating controls need documentation
Undocumented workarounds fail audits — reviewers ask why MFA is missing and what replaces it. Permanent compensating without expiry stalls remediation. Shared vocabulary aligns security and operations on the same gap ID in architecture registers.
Students assign lab compensating controls on notes — production compensating follows change control and risk acceptance.
3. Lab boundary
Forbidden: marking every gap Accepted without compensating control to skip work. Allowed: compensating controls card — gap and alternative with $ARCH_LAB fictional example.
Ship: compensating row for YOUR lab gap. Next: Defense Lab.
4. What you ship: compensating control row for $ARCH_LAB
Primary gap, compensating control, owner, review date. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Compensating row. $ARCH_LAB named. File t41-m02-l03-compensating-controls.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Skip compensating documentation because 'we'll fix it later.' Choose compensating with no owner named.
- Right: Write compensating control row for YOUR $ARCH_LAB fictional gap. Next: Defense Lab.
Mission: document compensating control on YOUR lab
1) Name primary control gap on fictional system. 2) Write compensating alternative. 3) Assign owner and review date. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Compensating controls need expiry — permanent workaround without review is architecture debt.
APPLY: Compensating controls primarily:
APPLY: True or False: Compensating controls require owner, residual risk note, and review date.
APPLY: Compensating controls literacy on Cyberlium uses: