Chapter 3 — Evidence handling and authorised data collection
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Collecting within scope"]
N2["3.2 Protecting exports"]
N3["3.3 Reproducibility"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Collecting within scope"]
N2["3.2 Protecting exports"]
N3["3.3 Reproducibility"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Collecting within scope]
|
v
[3.2 Protecting exports]
|
v
[3.3 Reproducibility]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) collect identity evidence within scope; (2) protect exports; (3) keep records reproducible.
3.1 Collecting within scope
Daniel needs evidence: user exports, group memberships, sign-in logs and admin role lists. He collects them through the admin consoles' export features, under his scope, and records what he exported, when and why. He does not open client folders or read mailboxes. Collecting only what the review needs keeps the work proportionate and respects staff and client privacy, and it means every finding can be traced to a specific, authorised export. Helen checks the evidence log weekly and asks him to justify any export whose purpose is unclear.
3.2 Protecting exports
Exports contain staff names, sign-in locations and sometimes client guest addresses. Daniel stores them in an encrypted folder accessible only to him and Helen, never on personal devices or in email. He deletes exports at the end of the course except those needed as evidence in the final report, which are kept with the firm under its retention rules. Treating exports as sensitive data prevents the security review itself from becoming a source of exposure. He records where each export is stored and when it will be deleted.
3.3 Reproducibility
For each finding, Daniel records the export file, date and the steps or script used, so Helen or the firm can repeat the analysis and get the same result. When a later export shows different numbers, he can tell whether the environment changed or his method did. Reproducible evidence makes findings credible to partners who must approve changes, and it allows progress to be measured fairly from the first review to the last. Helen tests this by repeating one analysis from his notes alone.
Worked example
Daniel records 14 exports with date, purpose and method in an evidence log; files are kept encrypted and shared only with Helen.
Synthetic case. Exports and logs are synthetic.
Errors and limits
Emailing exports of sign-in logs exposes staff data unnecessarily.
Exercises
- EX011 — Collection method. How are exports collected? Rubric: 3 = admin console export features within scope;; 2 = console;; 1 = copying files;; 0 = none.
- EX012 — Not touched. Name one thing Daniel does not access. Rubric: 3 = client folders or mailboxes;; 2 = client folders;; 1 = exports;; 0 = none.
- EX013 — Export storage. Where are exports stored? Rubric: 3 = encrypted folder for him and Helen only;; 2 = encrypted;; 1 = email;; 0 = none.
- EX014 — Reproducible record. What is recorded per finding? Rubric: 3 = export file, date and method;; 2 = source;; 1 = vague;; 0 = none.
- EX015 — Retention end. What happens to exports at the end? Rubric: 3 = deleted except evidence kept under firm rules;; 2 = deleted;; 1 = kept forever;; 0 = none.
Synthesis
Scoped, protected and reproducible evidence makes identity findings trustworthy.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →