Cheat notes · Module 00 · Orientation
Orientation
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Map the delivery path and name the seven surfaces before changing them. A running local checkout service, a connected public repository, and seven open surface entries.
Remember
- Surface: A surface is a point where data crosses a trust boundary.
- Trust: A capability is permission to change code, publish an artifact, or reach data.
- Evidence: Orientation: a label is not evidence
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
A surface is a point where data crosses a trust boundary.
What do you test?
Create the learner repo, inspect the seeded app and workflows, and open docs/attack-surface.yaml.
What proves the control holds?
A running local checkout service, a connected public repository, and seven open surface entries.
Where module 00 leaves you: A running local checkout service, a connected public repository, and seven open surface entries.