One permitted check is not a survey

Lesson map

Lesson 16. Map, example, EX062.

flowchart TD
  T["Ellen permits a simple check"] --> P["Leo's phone on the guest network"]
  P --> I["Internet reachable"]
  P --> O["Office computer not reachable"]
  I --> S["Scope stops there"]
  O --> S

The check has one client, one target that must fail, and a permission.

Logical drawing

client     Leo's phone, guest network
reaches    the internet
does not  the office computer
not tested in this sentence
           tills, card reader, speaker, scanner
no capture, no scan procedure, no command

Learning outcomes

After this chapter, you should be able to:

1. Restate the isolation check without widening it.
2. Explain why a quiet result is not a measured detection rate.
3. Keep the next morning's call as a business check.

16.1 The result is one observation under a written permission.

Chapter 4 records a specific test. With Ellen's permission, Leo joins his own phone to the guest network and confirms two things: it can reach the internet, and it cannot reach the office computer. He does not try anything beyond that simple connection check. The sentence does not name the tills, the card reader, the speaker, or the scanner as targets. It does not mention a packet capture, a scanner, or a command. Those omissions are the scope. Filling them in would turn a permitted check into an investigation chapter 2 forbids, including the rule that an unexpected device is not something Leo connects to.

A single negative result is easy to over-read. NIST SP 800-94 describes intrusion detection and prevention as systems that must be tuned, fed, and judged against false alarms and missed events. Axelsson's base-rate argument is the statistical reason a rare event makes an alert, or a silence, hard to interpret: most moments are ordinary, so a detector's errors dominate unless the base rate is taken seriously. The bakery did not install such a system. Paxson's Bro paper and the later caution from Sommer and Paxson about machine-learning detectors are references for that class of tool. They are not results from Bramble Street. One phone failing to reach one computer is evidence about that attempt. It is not a false-negative rate, and it is not a statement that every other path is closed.

The next morning's call is a different observation again. Leo asks whether opening went smoothly. That checks the business consequence of the change window. It does not repeat the guest-phone test, and it does not create a log line. Chapter 2's odd-message rule still stands: if a router log had shown something unexpected, Leo would stop and ask. No log line is printed. RFC 5424 describes syslog as a way to carry messages. It does not supply a message this file lacks. IPFIX, RFC 7011, is a way to export flow records. No flow was exported here. A lease remains a lease.

16.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. Leo's phone is the test client. It is not a new row in the lease print.

Errors and limits

Permission makes the check lawful and small. It does not make the check complete.

Apply

• EX062 — What was the check? Leo's phone on the guest network reaches the internet and not the office computer. Ellen permitted that check. Which other devices did it include, and what detection rate do you report?
  Show marking criteria

  Rubric: 3 = no other device is added as a target; no command, capture, or scan is added; no detection rate is computed; the morning call stays a separate business check; no log line or flow export is invented;; 2 = the check stays one phone and one office computer;; 1 = the permission only;; 0 = none.