Chapter 48 — Evidence dossier
Lesson map
Lesson 48 published. Map, example, EX142.
flowchart TD
N0["Learning outcomes"]
N1["48.1 Purpose of the dossier"]
N2["48.2 Linking evidence"]
N3["48.3 Protecting sensitive evidence"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX142"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["48.1 Purpose of the dossier"]
N2["48.2 Linking evidence"]
N3["48.3 Protecting sensitive evidence"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX142"]
[Learning outcomes]
|
v
[48.1 Purpose of the dossier]
|
v
[48.2 Linking evidence]
|
v
[48.3 Protecting sensitive evidence]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX142]
Learning outcomes
You will (1) assemble an evidence dossier for regulators and assessors; (2) link evidence to requirements and risks; (3) protect sensitive evidence.
48.1 Purpose of the dossier
The regulator requires Ridgeway to demonstrate that its metering trust service is adequately secured. Aiyana assembles an evidence dossier: requirements, architecture, risk register, control map, test reports, independent testing summary, ceremony minutes, trial findings and residual-risk statements. The dossier is organised by requirement, so an assessor can follow any requirement to its design, tests and operational evidence. A dossier turns years of work into an auditable argument rather than a pile of documents. It also gives future engineers a single map of why the system looks the way it does.
48.2 Linking evidence
For each requirement the dossier includes a short claim, the evidence supporting it and any limitations. For example, the claim that readings cannot be forged without a meter key links to the HMAC design, laboratory negative tests, the independent test finding no forgery and monitoring data showing verification failures investigated. Where evidence is weaker, such as side-channel resistance tested on one hardware revision, the dossier says so. Aiyana uses SHA-256 digests to identify each evidence file, so assessors can confirm they examined the exact versions referenced.
48.3 Protecting sensitive evidence
Some evidence would help attackers, such as detailed penetration test reports or HSM configuration. Aiyana classifies each item: public summaries, regulator-only material and internal-only material available for on-site inspection. Key material never appears in any dossier. Ceremony minutes include key identifiers and fingerprints but not keys. She agrees handling rules with the regulator. Evidence that protects the public must not itself become a risk to the public. Access to regulator-only and internal material is logged, and copies are numbered so that any leak could be traced back to a specific recipient.
Worked example
Aiyana's dossier organises evidence by requirement, links claims to tests and operations with digests, and classifies sensitive items with agreed handling.
Synthetic case. The dossier is invented.
Errors and limits
Dossiers that hide weak evidence lose credibility when assessors find gaps. Over-sharing detailed test reports increases risk.
Exercises
- EX142 — Dossier organisation. How is the dossier organised and why? Rubric: 3 = by requirement, so assessors can trace each to design, tests and operations;; 2 = requirement;; 1 = date;; 0 = none.
- EX143 — Weak evidence. How does the dossier treat weaker evidence? Rubric: 3 = states its limits openly, e.g. side-channel tests on one revision;; 2 = honest;; 1 = hides;; 0 = none.
- EX144 — Ceremony minutes. What do ceremony minutes include and exclude? Rubric: 3 = key identifiers and fingerprints, never key material;; 2 = fingerprints;; 1 = keys;; 0 = none.
Synthesis
An evidence dossier organised by requirement, honest about limits and careful with sensitive material makes security claims auditable.
Continue studying — chapter 48 of 50
← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →