jperezduerto.info
Security in depth · Unit 29 · Lesson 7 of 9
Some evidence disappears as systems change
Balance a temporary memory record against an explicitly documented harm deadline.
Helpful before thisIncident response: decisions under uncertainty
After this lesson you can
- Explain a response decision that records evidence loss rather than hiding the tradeoff.
Preservation has value, but it is not the only incident objective.
Identify what the question needs
Volatile evidence can disappear or change as time passes, processes end, or power is removed. Running memory might help explain a process’s current state, while retained audit records may document earlier actions. Their evidentiary value depends on the investigation question; they are not interchangeable copies.
Assume a fictional archive has documented continuing corruption by a local process. Its incident lead has approved a protective stop under the organization’s procedure. The exercise concerns the decision and its record, not the technical steps for stopping or collecting anything.
Supplied decision constraints
- V1: Additional archive entries are being corrupted. The approved response permits at most five more minutes of this activity.
- V2: A qualified specialist cannot begin the relevant memory collection for twenty minutes. The protective stop is expected to remove the running memory state.
- V3: Independently retained audit records are available, but do not contain the process’s complete in-memory state.
Record the cost of the choice
Waiting for V2 exceeds V1’s approved limit. Proceeding with the protective stop is supported by these specific facts, while acknowledging that some investigation questions may remain unanswered. This is not a universal recommendation to shut down every suspicious system.
Document the decision time, approving role, continuing harm, unavailable collection window, and expected evidence loss. Preserve the available audit record through the established evidence process. Do not describe it as a reconstruction of memory that was never captured.
If circumstances allowed timely, qualified collection without unacceptable harm, the balance could differ.
Model conclusion: The authorized harm limit controls this decision. Preserve available records and explicitly carry forward the limitation from lost volatile state.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which decision follows the stated policy and evidence?
Show the answer
Correct answer: Proceed with the authorized protective stop and document the likely loss of volatile information. The harm deadline is five minutes, while qualified collection cannot begin for twenty. The decision follows the supplied priority and preserves its evidentiary limitation.
Try it
- WriteWrite a decision note for V1-V3: authorized priority, likely information loss, preserved alternative evidence, and remaining investigation limit. Do not claim a disk record replaces live memory.