Chapter 48 — Evidence dossier

Chapter 48 — Evidence dossier

Lesson map

Lesson 48 published. Map, example, EX142.

flowchart TD
  N0["Learning outcomes"]
  N1["48.1 Claims"]
  N2["48.2 Linking evidence"]
  N3["48.3 Limitations"]
  N4["48.4 Use"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX142"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["48.1 Claims"]
  N2["48.2 Linking evidence"]
  N3["48.3 Limitations"]
  N4["48.4 Use"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX142"]

[Learning outcomes]
    |
    v
[48.1 Claims]
    |
    v
[48.2 Linking evidence]
    |
    v
[48.3 Limitations]
    |
    v
[48.4 Use]
    |
    v
[Worked example] --> [Exercise EX142]

Learning outcomes

You will (1) assemble evidence supporting security claims; (2) link each claim to verifiable records; (3) state limitations of the evidence.

48.1 Claims

Lindiwe assembles an evidence dossier for Saltmarsh's directors and auditors. She lists claims: assets are reconciled weekly; servers meet baseline rules at a measured rate; password guessing is detected; backups are verified by restore tests; dispatch can be recovered within four hours. Each claim must point to evidence. Prof. Hale warns her not to include claims she cannot support, however desirable they sound. She drafts each claim as a single sentence, checks it with the owner of the control and removes one claim about phishing awareness she could not support.

48.2 Linking evidence

For each claim, Lindiwe links records: the reconciliation reports with the original lab figures of 63 unregistered and 90 silent hosts and later improvements; baseline results starting at 72.0 percent passing all rules; the guessing measure's detections and its boundary test; restore tests starting at 98.4 percent verified; and the recovery trial timelines. Every record is indexed with a checksum. A reader can trace any claim to its source within minutes. The index lists each record's date, owner, file name and checksum, grouped by the claim it supports.

48.3 Limitations

The dossier states limits plainly. The guessing measure misses slow attacks. The address-change control is verified but not validated. Recovery trials were run in an isolated environment, which may differ from a real incident. Baseline rules cover three settings, not full hardening. Lindiwe notes that stating limits makes the dossier more credible, because readers can see what has and has not been shown. Prof. Hale reviews the section and asks her to place each limitation directly after the claim it affects, so readers cannot miss it.

48.4 Use

The security lead uses the dossier in the external audit and in a tender response for a new customer. The auditor samples five claims and traces each to evidence without difficulty. Lindiwe learns that a dossier built from records created during normal work costs little to maintain, while one assembled under deadline pressure tends to contain gaps and inconsistent figures. The security lead adds the dossier to the team's routine work, assigning each claim's owner the task of updating its evidence after every relevant test or change.

Worked example

Lindiwe assembles five claims, links each to checksummed records including lab figures, states four limitations and supports an audit that traces sampled claims easily.

Synthetic case. The dossier is synthetic.

Errors and limits

Including claims without evidence undermines the whole dossier.

Exercises

• EX142 — Dossier claim. Name one claim in the dossier. Rubric: 3 = dispatch can be recovered within four hours;; 2 = one;; 1 = vague;; 0 = none.
• EX143 — Baseline starting rate. What baseline rate starts the record? Rubric: 3 = 72.0 percent passing all rules;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX144 — Auditor sample. How many claims did the auditor sample? Rubric: 3 = five;; 2 = partly correct;; 1 = wrong;; 0 = none.

Continue studying — lesson 48 (chapter 48 of 50)

← Chapter 47 · Course chapter index · Chapter 49 →

Continue to the next authored lesson.