## Chapter 16 — One permitted check is not a survey ### Lesson map Lesson 16. Map, example, EX062. ```mermaid flowchart TD T["Ellen permits a simple check"] --> P["Leo's phone on the guest network"] P --> I["Internet reachable"] P --> O["Office computer not reachable"] I --> S["Scope stops there"] O --> S ``` The check has one client, one target that must fail, and a permission. ### Logical drawing ```text client Leo's phone, guest network reaches the internet does not the office computer not tested in this sentence tills, card reader, speaker, scanner no capture, no scan procedure, no command ``` ### Learning outcomes After this chapter, you should be able to: 1. Restate the isolation check without widening it. 2. Explain why a quiet result is not a measured detection rate. 3. Keep the next morning's call as a business check. ### 16.1 The result is one observation under a written permission. Chapter 4 records a specific test. With Ellen's permission, Leo joins his own phone to the guest network and confirms two things: it can reach the internet, and it cannot reach the office computer. He does not try anything beyond that simple connection check. The sentence does not name the tills, the card reader, the speaker, or the scanner as targets. It does not mention a packet capture, a scanner, or a command. Those omissions are the scope. Filling them in would turn a permitted check into an investigation chapter 2 forbids, including the rule that an unexpected device is not something Leo connects to. A single negative result is easy to over-read. NIST SP 800-94 describes intrusion detection and prevention as systems that must be tuned, fed, and judged against false alarms and missed events. Axelsson's base-rate argument is the statistical reason a rare event makes an alert, or a silence, hard to interpret: most moments are ordinary, so a detector's errors dominate unless the base rate is taken seriously. The bakery did not install such a system. Paxson's Bro paper and the later caution from Sommer and Paxson about machine-learning detectors are references for that class of tool. They are not results from Bramble Street. One phone failing to reach one computer is evidence about that attempt. It is not a false-negative rate, and it is not a statement that every other path is closed. The next morning's call is a different observation again. Leo asks whether opening went smoothly. That checks the business consequence of the change window. It does not repeat the guest-phone test, and it does not create a log line. Chapter 2's odd-message rule still stands: if a router log had shown something unexpected, Leo would stop and ask. No log line is printed. RFC 5424 describes syslog as a way to carry messages. It does not supply a message this file lacks. IPFIX, RFC 7011, is a way to export flow records. No flow was exported here. A lease remains a lease. ### 16.2 Worked example | Widening | Why it is not the check | Decision | |---|---|---| | "The phone reached the internet and not the office computer." | The recorded result | May stay | | "No command is written down." | The file | May stay | | "The tills were scanned the same evening." | Not in the sentence | Refuse | | "Silence means a measured detection rate." | No detector was installed | Refuse | > **Synthetic case.** Leo's phone is the test client. It is not a new row in the lease print. ### Errors and limits Permission makes the check lawful and small. It does not make the check complete. ### Apply - **EX062 — What was the check?** Leo's phone on the guest network reaches the internet and not the office computer. Ellen permitted that check. Which other devices did it include, and what detection rate do you report? *Rubric:* 3 = no other device is added as a target; no command, capture, or scan is added; no detection rate is computed; the morning call stays a separate business check; no log line or flow export is invented;; 2 = the check stays one phone and one office computer;; 1 = the permission only;; 0 = none. ### Continue studying — lesson 16 (chapter 16 of 20) [← Chapter 15](#ch-15) · [Course chapter index](../SUBJECTS.md) · [Chapter 17 →](#ch-17) Continue to the next authored lesson. ## Worked answers **EX062.** The check stays one phone, the internet, and the office computer. No other target, command, capture, scan, or detection rate is added. The morning call stays separate. No log line or flow export is invented.