Containment
A field guide to what lives in an estate.
Every one of these was met in a live tenant. Each record says what it does, how it got in, and how to go looking for it.
Specimens are composites. The creatures are real.
Classification
- Dormant
- Does nothing at all, and is armed the entire time.
- Endemic
- Found in most estates where somebody goes looking.
- Active
- Feeds continuously, and produces no operational symptom while it does.
- Breach
- Something has already come through. No longer a finding.
- Greenfield event
- Rebuilding the estate has become cheaper than correcting it.
-
Specimen I · Authorization
The Tenant
Access that outlived the person it was granted to.
Endemic
-
Specimen II · Evidence retention
The Archivist
It curates your logs. Nothing it takes is broken on the way out.
Active
-
Specimen III · Standing privilege
The Sleeper
The only specimen that is invisible while working exactly as designed.
Dormant
-
Specimen IV · Network exposure
The Invitation
The mature form wears a source restriction, because that form survives review.
Active
-
Specimen V · Assurance
The All-Clear
The dashboard answers a narrower question than anyone believes it is being asked.
Endemic
-
Specimen VI · Governance override
The Sponsor
It requires a large security apparatus to survive. The apparatus is the habitat.
Endemic
-
Specimen VII · Change scheduling
The Goodwill
It prevents outages. Nobody hunts a thing that keeps the platform up.
Endemic
-
Specimen VIII · Diagnosis
The Alibi
A component excluded from suspicion by its price. It shelters the fault.
Endemic
