incident-response-trainer
Incident response training · Rule-based scoring
DemoCatalogHistoryDashboard
← Back to catalog
Cyber × Network Fusionextremely-hardTri-Domain: Pipeline → IaC Segmentation Break → Cloud IAM CrisisCritical asset
Scenario

An abused deploy pipeline pushed an IaC change that collapsed segmentation around the regulated zone and minted a cloud admin role — while a tainted build shipped to the fleet

A extremely-hard Cyber × Network Fusion scenario on Tri-Domain: Pipeline → IaC Segmentation Break → Cloud IAM Crisis.

Practice this scenario

Start a graded attempt against this scenario. Your response is scored by the same deterministic rubric used across the catalog. Email and evidence content stay hidden until you start.

Launches this exact scenario. One of 6 templates in this Track + Difficulty pool.

catalog id · fusion-tri-domain-pipeline-iac-segmentation-crisis

Training alignment

What this scenario practices, mapped to recognized frameworks.

Educational mapping only. Not a compliance attestation.

What this trains
  • Contain an abused CI/CD pipeline that collapsed segmentation and minted a cloud admin role
  • Evidence-preserving rollback to a known-good IaC state without halting delivery
MITRE ATT&CKmitre-attack
  • Trusted Relationship · Initial AccessT1199 · TA0001
    MappedHigh confidence

    Trains response to abuse of a trusted CI/CD deploy pipeline applying an unreviewed infrastructure-as-code change.

  • Account Manipulation: Additional Cloud Roles · PersistenceT1098.003 · TA0003
    MappedHigh confidence

    Trains detecting and removing the new wildcard-admin IAM role the pipeline run created as cloud persistence.

  • Impair Defenses: Disable or Modify Cloud Firewall · Defense EvasionT1562.007 · TA0005
    PartialMedium confidence

    Trains the defender side: recognizing that the IaC run rewrote a security group / ACL and collapsed mandatory regulated-zone segmentation.

MITRE D3FENDmitre-d3fend
  • User Account ContainmentD3-UAC
    MappedHigh confidence

    Trains suspending the pipeline identity and revoking its sessions so it cannot apply further control-plane changes.

  • Resource Access Policy AuditingD3-RAPA
    MappedHigh confidence

    Trains auditing the IaC-applied IAM role trust and the rewritten network policy to scope the blast radius.

  • Service Binary VerificationD3-SBV
    MappedMedium confidence

    Trains verifying the unsigned artifact from the unapproved registry against a signed known-good build before any reuse.

NIST CSF 2.0nist-csf-2
  • Adverse Event Analysis · DetectDE.AE · DE
    MappedHigh confidence

    Trains separating a genuine deploy from adversary activity across pipeline, cloud IAM, and network telemetry.

  • Mitigation · RespondRS.MI · RS
    MappedHigh confidence

    Trains re-isolating the regulated zone and freezing the pipeline without halting every team's delivery.

  • Incident Recovery Plan Execution · RecoverRC.RP · RC
    MappedMedium confidence

    Trains rolling IaC back to a reviewed known-good state and rebuilding from signed artifacts after evidence capture.

NIST SP 800-61r3nist-sp-800-61r3
  • IR lifecycle phaseDetection & Analysis
    MappedHigh confidence

    Trains reconstructing the run from cloud audit and version-control history when pipeline logs are only partially retained.

  • IR lifecycle phaseContainment, Eradication & Recovery
    MappedHigh confidence

    Trains evidence-preserving containment instead of blind-reverting all IaC or freezing the whole business.

  • IR lifecycle phasePost-Incident Activity
    MappedMedium confidence

    Trains hardening to least-privilege per-job pipeline identities, IaC peer review, and segmentation-as-code drift detection.

CISA Cybersecurity Performance Goalscisa-cpg
  • Detecting Relevant Threats and TTPs3.A
    MappedHigh confidence

    Trains the detection baseline that surfaces IAM role creation and regulated-zone ACL changes from a deploy pipeline.

  • Log Collection2.T
    MappedMedium confidence

    Trains preserving cloud audit, version-control history, and artifact provenance to reconstruct the partial trail.

CIS Controls v8cis-controls
  • Access Control ManagementControl 6
    MappedHigh confidence

    Trains scoping the pipeline identity to least privilege and removing the unrequested admin IAM role.

  • Network Infrastructure ManagementControl 12
    MappedHigh confidence

    Trains restoring the collapsed regulated-zone segmentation and managing it as reviewed network policy.

  • Application Software SecurityControl 16
    MappedMedium confidence

    Trains securing the CI/CD pipeline and requiring signed, provenance-verified artifacts.