jperezduerto.info
Security in depth · Unit 22 · Lesson 36 of 44
Protect local credential copies
Follow a fictional credential copy from protected disk to a diagnostic bundle with broader readers.
Helpful before thisWindows privilege escalation
After this lesson you can
- Separate offline storage protection, runtime readership, and credential invalidation.
A secret can acquire new readers
An application credential is useful only within an intended access boundary. Settings, diagnostic bundles, support uploads, and backups can create extra copies with different readers. The original file’s protection does not automatically travel with every export.
Disk encryption addresses specified offline storage risks. When Windows has unlocked the volume, ordinary access decisions still determine which running identities can read usable data. Encryption is therefore complementary to runtime authorization, not proof that every application secret remains private.
Supplied copy register
The fictional StockClient credential is represented only by the label Secret S; no credential value appears in this exercise.
| Copy | Supplied readers |
|---|---|
| Application store | Required application identity |
| Diagnostic bundle | General support group |
| Laptop disk | BitLocker protection active |
The owner approves only the application identity as a usable-secret reader. Assume the bundle contains a usable copy and the listed support access is effective. The register does not show whether anyone retrieved or used it.
Handle the credential and the copies
Record the excess readership and assign the application owner to decide controlled replacement and revocation: making the old credential no longer accepted. Removing a visible file is not the same action as invalidating its credential. Preserve necessary incident context without creating more copies of the secret itself.
Acceptance should show that required application work continues, the old credential is no longer accepted when invalidation is required, and future bundles omit usable credentials. Review retained copies and access separately. The evidence supports a handling deviation; historical misuse remains unconfirmed.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
The laptop is encrypted, but a diagnostic bundle contains an application credential and is readable by a broader support group. What is supported?
Show the answer
Correct answer: The bundle creates a separate reader boundary that encryption of the laptop does not resolve. The supplied live access permits readers beyond the credential's approved application identity.
Try it
- WriteWrite a four-part handling note: copies and readers, confirmed policy deviation, owner-approved replacement/invalidation decision, and acceptance evidence. Include one uncertainty about historical use.