Chapter 38 — Information security: validation
Lesson map
Lesson 38 published. Map, example, EX112.
flowchart TD
N0["Learning outcomes"]
N1["38.1 Verification and validation"]
N2["38.2 Owner feedback"]
N3["38.3 Incident review evidence"]
N4["38.4 Validation report"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX112"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["38.1 Verification and validation"]
N2["38.2 Owner feedback"]
N3["38.3 Incident review evidence"]
N4["38.4 Validation report"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX112"]
[Learning outcomes]
|
v
[38.1 Verification and validation]
|
v
[38.2 Owner feedback]
|
v
[38.3 Incident review evidence]
|
v
[38.4 Validation report]
|
v
[Worked example] --> [Exercise EX112]
Learning outcomes
You will (1) validate that controls meet business needs; (2) gather user and owner feedback; (3) distinguish verification from validation.
38.1 Verification and validation
Lindiwe distinguishes two questions. Verification asks whether a control was built as specified; her laboratory tests answered that. Validation asks whether the control meets the real need. The password-guessing measure works as specified, but does it help Saltmarsh reduce account takeover? She designs validation activities: interviews with the security team about alert usefulness, review of incidents to see whether measures detected them and comparison with business objectives. Prof. Hale asks her to apply these activities to every control built during the course and to report the results together.
38.2 Owner feedback
Lindiwe interviews system owners about the controls affecting them. The dispatch owner finds the address-change approval useful but says the threshold catches some regular large customers unnecessarily. The payroll owner wants clearer baseline reports. She records each point and proposes adjustments. Prof. Hale notes that owners' views reveal whether controls fit the work, which tests alone cannot show, and that controls owners dislike are often quietly weakened. She raises the threshold slightly for customers with a verified history and records the change with its reasoning.
38.3 Incident review evidence
Lindiwe reviews six synthetic incidents from the year. Four were detected by controls built during the course, one by a customer complaint and one by an external notification. The two missed detections point to gaps: no monitoring of email forwarding rules and no alert for bulk downloads from the customer portal. She adds both to the improvement plan. She learns that incidents provide the most direct validation evidence. The two gaps are assigned named owners and target dates in the improvement plan.
38.4 Validation report
Her report states for each control whether it is verified, validated, partially validated or not yet validated, with evidence. The password-guessing measure is validated by two detected incidents; the address-change control is verified but not yet validated because no fraud attempt has occurred. Prof. Hale praises the honest distinction. She notes that claiming validation without evidence would mislead the board about how well the controls protect the business. The report is presented to Saltmarsh's security committee, which asks for a repeat assessment after six months.
Worked example
Lindiwe distinguishes verification from validation, gathers owner feedback, finds two detection gaps from six incidents and reports each control's validation status with evidence.
Synthetic case. Incidents are synthetic.
Errors and limits
A control can be built correctly and still fail to meet the real need.
Exercises
- EX112 — Detected incidents. How many of six incidents did course controls detect? Rubric: 3 = four;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX113 — Missed gaps. Name one detection gap found. Rubric: 3 = email forwarding rules;; 2 = one;; 1 = vague;; 0 = none.
- EX114 — Address status. What is the address-change control's status? Rubric: 3 = verified but not yet validated;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 38 (chapter 38 of 50)
← Chapter 37 · Course chapter index · Chapter 39 →
Continue to the next authored lesson.