Chapter 5 — Security scope and evidence
Lesson map
Lesson 05 published. Map, example, EX017.
flowchart TD
N0["Learning outcomes"]
N1["5.1 Technician ROE"]
N2["5.2 Hashing"]
N3["5.3 Minimisation"]
N4["5.4 Evidence index"]
N5["5.5 Integrity vs truth"]
N6["5.6 Retention"]
N7["5.7 Photographing screens"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX017"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 Technician ROE"]
N2["5.2 Hashing"]
N3["5.3 Minimisation"]
N4["5.4 Evidence index"]
N5["5.5 Integrity vs truth"]
N6["5.6 Retention"]
N7["5.7 Photographing screens"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX017"]
[Learning outcomes]
|
v
[5.1 Technician ROE]
|
v
[5.2 Hashing]
|
v
[5.3 Minimisation]
|
v
[5.4 Evidence index]
|
v
[5.5 Integrity vs truth]
|
v
[5.6 Retention]
|
v
[5.7 Photographing screens]
|
v
[Worked example] --> [Exercise EX017]
Learning outcomes
You will (1) restate ROE checks for technicians; (2) hash evidence files; (3) reject mismatched evidence; (4) minimise personal data in captures.
5.1 Technician ROE
Before any command, Sam confirms target host, method and window against the ROE sheet on his knee. The technician ROE for ENG-512 states the staging web/API and VPN checks, the Saturday window, the emergency contact, and the fare network as excluded. Sam will not start if emergency_contact is empty; the checklist is the same habit taught in professional labs. An empty emergency_contact cancels ENG-512 before tools start, and Sam posts the cancel with the missing field named so the SOC does not expect traffic that morning. The window is rescheduled only after the ROE owner fills the field and re-signs the sheet.
5.2 Hashing
Hashing evidence detects accidental edits. A mismatch means do not attach the file until the lineage is clear.
"""Lab 5: verify synthetic evidence file hashes before attaching to a finding."""
import hashlib
files = {"shot1.png": b"fake-png-bytes-v1", "shot1-edited.png": b"fake-png-bytes-v2",
"config.txt": b"PermitRootLogin no\n"}
recorded = {k: hashlib.sha256(v).hexdigest() for k, v in files.items() if k != "shot1-edited.png"}
recorded["shot1.png"] = hashlib.sha256(b"fake-png-bytes-v1").hexdigest()
# simulate tampering record for edited shot still labeled shot1
check = {"shot1.png": files["shot1-edited.png"], "config.txt": files["config.txt"]}
for name, data in check.items():
h = hashlib.sha256(data).hexdigest()
print(f"{name:12} {h[:12]} {'MATCH' if h == recorded.get(name) else 'MISMATCH'}")
Run with python3 lab_hash.py. Verified output:
shot1.png b81db4df801a MISMATCH
config.txt 44c91857f34b MATCH
lab_hash prints shot1.png b81db4df801a MISMATCH and config.txt 44c91857f34b MATCH. Sam treats the MISMATCH as a stop on that artefact: shot1.png stays out of the finding until two people agree on a re-export or an updated expected hash. MATCH on config.txt is the pattern tickets should show after fixes.
5.3 Minimisation
Blur rider faces and badge numbers in screenshots; keep the pixels that prove the issue. Minimisation means that rider names and card numbers never appear in ENG-512 screenshots. Evidence that proves a cookie flag or an open port does not need a real journey history, so Sam proves those issues with synthetic sessions and cropped interface chrome only, and he crops before hashing. Unknown JSON keys that look payment-shaped are stripped before any log line leaves the jump host for the vault.
5.4 Evidence index
Each file has an id, hash, time, collector and related finding id. In ENG-512 the index rows carry the filename, a twelve-hex-character SHA-256 prefix, the ENG-512 ticket id and the owner. An artefact not on the index is not part of ENG-512; personal chat links do not count, and artefacts missing from the index are deleted as unverified copies. The index is what lets a reviewer match each finding in the report to the exact file and hash that supports it.
5.5 Integrity vs truth
A matching hash proves the file is unchanged since hashing, not that the underlying system finding is still true. A MATCH on a wrong screenshot still fails the truth check. Sam therefore validates the finding path and its impact with the method card before calling the evidence complete and before the report ships. Integrity and truth are recorded as two separate ticks in the ENG-512 pack, so a reader can see that both were checked and by whom. A finding with only the integrity tick stays in draft.
5.6 Retention
Follow NMT's engagement retention schedule and delete local caches after vaulting. Retention for ENG-512 follows the ROE delete-within rule. Sam diaries the deletion of ENG-512 evidence and confirms it; each deletion diary entry records the date, the path and a witness. Leftover PNGs on the jump host fail the cleanup gate for portfolio credit. Retention cuts both ways: evidence is kept long enough for retest and dispute, and not a day longer than the ROE allows. The witness signs the diary entry, not Sam alone.
5.7 Photographing screens
When a screenshot is required, Sam uses the jump host's tools, names the file with finding id and time, and hashes it before editing anything; redaction is done on a copy. Photographing screens with a phone is refused when the jump host can capture a redacted PNG, because phones leave NMT control while vaulted screenshots stay in the engagement path. Phone photos of screens are rejected in peer review, and jump-host capture with redaction is the only accepted screenshot path.
5.8 Two-person evidence rule
For high-impact findings, a second technician confirms the hash and the observation, and disagreement pauses filing. Under this rule a peer watches hash generation for high-impact items. The MISMATCH on shot1.png is reviewed by both people before anyone updates the expected hash, and the peer sits at the keyboard during the re-hash. Solo hash updates on shot1.png are refused. The peer's name is written beside the new hash in the evidence index, so the approval can be traced later.
5.9 Field discipline
Evidence disputes are expensive. Sam therefore hashes immediately after capture, writes the hash into the activity log line, and only then redacts a copy for the report appendix. If legal later asks whether a screenshot was altered, he can show the original digest and the redacted derivative. The MISMATCH result in the lab is the classroom version of that discipline: edited bytes must never silently replace originals, and a MISMATCH is the cue to call a second person, not to re-hash until it matches. Field discipline for evidence is hash, minimise, index, retain, and two people on mismatches; Sam's ENG-512 pack fails peer check if any of those five is missing.
Worked example (synthetic NMT)
Sam hashes evidence: config.txt MATCH; shot1.png MISMATCH because the bytes were edited after the recorded hash. He re-captures the screenshot and records a new hash.
Synthetic case — Northline Municipal Transit (NMT). The transit agency, Sam Park and all figures are invented for teaching.
Errors and limits
Live transit systems and fare equipment are never tested without a separate, specialised authorization. This book uses synthetic data only and grants no authority to test real systems.
Exercises
- EX017 — Mismatch action. What does Sam do with shot1.png MISMATCH? Rubric: 3 = do not attach; re-capture; new hash; 2 = partial; 1 = attach anyway; 0 = none.
- EX018 — Match meaning. What does MATCH prove for config.txt? Rubric: 3 = unchanged since hash recorded; 2 = partial; 1 = system is secure; 0 = none.
- EX019 — Minimisation. Give one minimisation example at NMT. Rubric: 3 = blur faces/badges/card numbers; 2 = partial; 1 = keep everything; 0 = none.
- EX020 — Knee card. What three facts are on Sam's ROE knee card? Rubric: 3 = host, method, window (plus emergency contact); 2 = two; 1 = one; 0 = none.
Synthesis
Scope on the knee card; evidence hashed, minimised and indexed.
Continue studying — chapter 05 of 18
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →