Control Status
Purpose
This page provides a synthetic view of the current implementation state of security controls within the Scheol Security Lab.
The objective is to:
- provide a quick visibility of control maturity
- identify priority gaps
- support risk-driven decision making
This page reflects the actual operational state of the lab.
Status Model
Each control is assigned one of the following statuses:
| Status | Description |
|---|---|
| Active | Control is implemented and operational |
| In Progress | Control is partially implemented |
| Planned | Control is defined but not yet implemented |
Global Overview
| Metric | Value |
|---|---|
| Total Controls | 7 |
| Active | 2 |
| In Progress | 2 |
| Planned | 3 |
Interpretation
- Core security foundations are partially in place
- Several critical controls remain unimplemented
- Current posture is transitional and exposed
Control Status Breakdown
| Control ID | Name | Status | Notes |
|---|---|---|---|
| C-001 | Reverse Proxy Exposure Control | Active | Reverse proxy in place, needs continuous review |
| C-002 | Network Segmentation Enforcement | Planned | No strong inter-zone isolation yet |
| C-003 | Web Application Hardening | In Progress | Partial hardening, needs consistency |
| C-004 | Data Access Restriction | Planned | No strict DB isolation yet |
| C-005 | Administrative Access Hardening | In Progress | SSH hardened, bastion missing |
| C-006 | Credential & Secrets Management | Active | Vault in use, no rotation policy |
| C-007 | Logging & Detection Baseline | Planned | No centralized logging yet |
Key Observations
1. Exposure Control Exists but Remains Fragile
- Reverse proxy is implemented (C-001)
- But lacks strong segmentation (C-002)
Direct link to R-001 risk exposure.
2. Application Security is Partially Controlled
- Hardening is started (C-003)
- Data protection still weak (C-004)
Direct link to R-002 risk.
3. Administrative Access is the Main Weak Point
- Basic hardening exists (C-005)
- No bastion, no strong isolation
Direct link to R-003 critical risk.
4. Detection Capability is Almost Absent
- No centralized logging (C-007)
Impacts all risks (R-001 to R-003)
Priority Areas
Based on current status, the highest priorities are:
- Administrative access control (C-005)
- Network segmentation (C-002)
- Logging & detection (C-007)
These controls have the highest impact on overall risk reduction.
Relationship with Risk Management
Control status directly reflects risk exposure:
- R-001 → partially mitigated (C-001 only)
- R-002 → weakly mitigated (C-003 partial)
- R-003 → high exposure (C-005 incomplete)
This confirms that the lab remains highly exposed to administrative compromise and lateral movement.
Limitations
- Status reflects implementation, not effectiveness
- Controls are not yet validated
- Some controls are intentionally deferred due to lab maturity
Validation will be addressed in the Validation & Monitoring section.
Current Maturity
Control implementation is considered early and transitional.
Established
- core exposure control (reverse proxy)
- basic credential management
In Progress
- application hardening
- administrative access security
Planned
- segmentation
- data access control
- detection and monitoring
The current focus remains closing high-impact gaps before expanding control coverage.