Skip to content
sec/atlas

follow the attack

Attack scenarios

Instead of seeing each control in isolation, follow an incident from start to finish. At each step, try to guess which control kicks in before revealing the answer.

A transitive library gains a critical vulnerability. See where each control comes in, from build to monitoring.

  1. 01 source
  2. 02 build
  3. 03 test
  4. 04 package
  5. 05 deploy
  6. 06 monitor

step 1 of 4

An indirect dependency, which nobody declared, is updated to a version with a critical CVE during the build.