Security › Module 2 › Lesson 3
Failure Domains
Compensating controls literacy names primary control gaps, alternative mitigations, risk acceptance linkage, and review cadence — document compensating row on YOUR $ARCH_LAB when primary control cannot deploy.
Visual · t41_compensating_controls
Compensating controls literacy. $ARCH_LAB only. Original Cyberlium.
Opening
Primary control missing is not silent gap — literacy teaches compensating control documentation so fictional org decisions on $ARCH_LAB stay defensible under architecture review.
When a primary control cannot be implemented — legacy system, vendor limitation, migration window — compensating controls reduce risk through alternative means: enhanced monitoring, network isolation, manual review procedures. Each compensating control needs gap description, alternative control, residual risk note, owner, and expiry on YOUR lab template. Cyberlium writes compensating row on YOUR $ARCH_LAB — primary gap, compensating control, owner, review date for one fictional LAB-ARCH-001 system. Next: Defense Lab.
1. Compensating control fields (named)
Primary gap: which control cannot deploy on YOUR fictional system. Compensating: alternative mitigation — enhanced logging, jump host, read-only access. Residual: risk level after compensating control. Owner and expiry: who maintains and when primary control replaces compensating.
On $ARCH_LAB, write compensating row — gap, alternative, owner, review date for one fictional scenario.
Command guide
Try these commands — Compensating control fields (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP Threat Modeling — https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html Microsoft SDL trust boundaries — https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
cat > "$ARCH_LAB/notes/trust-boundaries-named.txt" <<'EOF'
Trust boundaries — NAMED LITERACY:
Definition: line where privilege level or data sensitivity changes
Examples (LAB-ARCH-001 fictional):
- Internet → API gateway (untrusted → semi-trusted)
- API gateway → internal microservices (authenticated zone)
- App tier → managed DB (data store boundary)
- Admin console → production control plane (high privilege)
Document: entry/exit points, protocols, authN/authZ, data crossing boundary
Lab: STRIDE worksheets in Module 4 reference these boundaries — defensive only
EOFCommand — copy this
grep -E 'Trust boundaries|API gateway|STRIDE' "$ARCH_LAB/notes/trust-boundaries-named.txt"
python3 -c "print('Trust boundaries: document where privilege changes — no attack recipes')"Primary tools to practice this lesson: grep, python3. Reference sites: OWASP Threat Modeling (https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html); Microsoft SDL trust boundaries (https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why compensating controls need documentation
Undocumented workarounds fail audits — reviewers ask why MFA is missing and what replaces it. Permanent compensating without expiry stalls remediation. Shared vocabulary aligns security and operations on the same gap ID in architecture registers.
Students assign lab compensating controls on notes — production compensating follows change control and risk acceptance.
3. Lab boundary
Forbidden: marking every gap Accepted without compensating control to skip work. Allowed: compensating controls card — gap and alternative with $ARCH_LAB fictional example.
Ship: compensating row for YOUR lab gap. Next: Defense Lab.
4. What you ship: compensating control row for $ARCH_LAB
Primary gap, compensating control, owner, review date. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Compensating row. $ARCH_LAB named. File t41-m02-l03-compensating-controls.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip compensating documentation because 'we'll fix it later.' Choose compensating with no owner named.
Right
Write compensating control row for YOUR $ARCH_LAB fictional gap. Next: Defense Lab.
Mission: document compensating control on YOUR lab
1) Name primary control gap on fictional system. 2) Write compensating alternative. 3) Assign owner and review date. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Compensating controls need expiry — permanent workaround without review is architecture debt.
Knowledge Check
APPLY: Compensating controls primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Compensating controls require owner, residual risk note, and review date.
True or False
Knowledge Check
APPLY: Compensating controls literacy on Cyberlium uses:
Multiple choice