Lion Cipher Lab
Build a continuous control monitoring pipeline: turn written controls into automated evidence with a real pass/fail and an audit-ready trail
- GRC / Compliance
- Advanced
- ~90 min
- Free · no account required
Why it matters
Almost every compliance programme runs on point-in-time assessment: once a year an assessor samples a control, someone pastes a screenshot into a folder, the control is marked satisfied, and that one day's evidence is silently asserted for the other 364. Everything that drifts in between — the contractor account nobody disabled, the log retention someone shortened to save money, the SSH box rebuilt from a stale image — is invisible until the next assessment, or until an incident. The screenshot itself is unverifiable: undated, unreproducible, and traceable to nothing. Continuous control…
What you'll learn
- decomposing a written control into an assessment objective, an observable, a query, a threshold and an evidence artifact
- recognising which controls genuinely do NOT automate, and saying so instead of faking coverage
- writing a stdlib-only Python collector that runs real read-only checks and emits structured PASS/FAIL records
- producing evidence with integrity: raw artifact + SHA-256 + RFC 3339 UTC timestamp + an append-only hash-chained ledger
- proving tamper-evidence with a live tamper test, and stating exactly what the hash chain does and does not prove
- rolling checks up into a control-effectiveness report with an honest coverage denominator (controls AND hosts)
- turning a failed check into a POA&M row with an owner, a severity and a due date — a failure policy, not a feeling
- gating cron/CI on a non-zero exit so a failing critical control blocks something, including when the collector itself stops running
- naming the real failure modes: alert fatigue, automatable-only bias, untraceable evidence, an over-privileged collector, sampling vs population
Steps in this lab
- The problem: a control tested once is asserted for 365 days
- What makes a control testable at all: the assessment objective
- The central skill: decompose five real controls into machine-testable assertions
- The controls that do NOT decompose — and why pretending otherwise is a lie
- Set up the workspace and write the control inventory as data
- Write ccm_lib.py: timestamps, evidence hashing, and the hash-chained ledger
- Write checks.py: the real, read-only checks
- Write collect.py and run your first collection
- Verify the ledger, then tamper with it on purpose
- What the hash chain proves — and, precisely, what it does not
- Write report.py: control effectiveness and an honest coverage denominator
- Read poam.csv: what a failed check actually TRIGGERS
- Write ccm_gate.py: make a failure actually block something
- The five failure modes that kill CCM programmes
- When CCM pays for itself, when it is premature, and how a pro does it better
- The judgment: automation makes controls honest, or it makes them decorative