Lesson 3.56: Policy versus configuration
A policy is a promise; the configuration is what actually happens. Auditors and attackers both look at the configuration. The gap between them is one of the most common findings in any review: the policy says MFA for everyone, the identity system exempts a group; the policy follows NIST SP 800-63B, the settings still force 90-day password changes. In the lab you compare Northwind's access control policy with an export of its identity provider settings, list every deviation, and prepare a configuration change that brings them together.
15 min
You will learn to
- Read policy statements as testable requirements
- Read configuration exports with jq
- Record deviations precisely
- Explain modern password guidance (NIST SP 800-63B)
- Prepare a configuration change or a risk acceptance
Key terms
- Policy / standard / procedure
- What must be achieved / the specific rules / the steps to follow.
- Deviation
- A difference between what a policy requires and what is in place.
- Exception (risk acceptance)
- A documented, approved and time-limited decision to allow a deviation.
- NIST SP 800-63B
- US guidance on authentication: length over complexity, breached-password checks, no forced periodic changes.
- Configuration export
- A machine-readable copy of a system's settings, used as audit evidence.
← MITRE ATT&CK: a shared language for attacker behaviour · All lessons · Continuous control monitoring →