Required
Intended boundary
Cyber
Security Boundary Drift
The service is up. The boundary in force is not the one intended.
More subjects hit a rule that is no longer the rule the owner intended.
DEMONSTRATION SCENARIO
This is a demonstration scenario. It is not a live demonstration and does not report an executed result.
The situation
A service is up. An intended access policy exists. An enforced policy also exists.
People are allowed, or denied, in a way the intended policy does not describe. The service itself has not crashed.
Why this is hard
An unexpected allow or deny can be two policy planes that diverged, a stolen session, or a bad shared key. The service can stay up through all three.
Revoking a session, or rotating a shared key, should not count as reconciling two policies.
What the operator can see
Gap
In force
A different rule
At risk. The next subject
What V8Y must determine
V8Y must distinguish an enforced rule from the intended rule, and from a stolen session or a bad signing key. Those are not the same repair.
What may happen next
More subjects hit the stale rule if the planes stay apart.
What counts as recovery
Not recovery
Success is not a reachable service.
Recovery
Success is that the unintended path stops and the intended path works.
Observed results
No executed results are published for this thread.
What this evaluation would test
- Two policy pictures, not one stolen session.
- The service can be up the whole time.
- Enforced and intended rules kept apart from a stolen session.
- Service-up is not the same as the intended boundary.
These are the conditions the evaluation would test. They are not reported results.
Operational basis
View operational basis and sources
Grounded in Cloudflare’s Thanksgiving 2023 incident, where a credential stayed usable after a rotation that should have removed it. Showing both a wrong allow and a wrong deny goes beyond that account and is synthetic.
Cloudflare. Thanksgiving 2023 security incident write-up. 2023.
Related threads
Same symptom. Different cause.
Access that should not be happening
Compromised SessionCompare with Compromised Session, which is one accepted session rather than two policies.
Discuss evaluating this situation
Does your environment face a similar problem?
The request keeps this mission and thread. It is not a claim that the demonstration has been validated in your environment.
The printable flyer is being revised and is not available for download.