jperezduerto.info
Security in depth · Unit 18 · Lesson 3 of 8
Keep observations attached to sources
Preserve source relationships so copied observations do not look like independent confirmation.
Helpful before thisReconnaissance: building an evidence-based map
After this lesson you can
- Distinguish duplicated observations from corroboration of a different claim.
One idea. One situation. One reasoned decision.
How it works
An inventory observation should retain where it came from, when it was collected, and what it actually establishes. A certificate record, a DNS answer, and an internal asset register have different meanings and lifetimes. Preserve those distinctions instead of merging them into a single unexplained “confirmed” label. Confidence can improve through independent corroboration, while disagreement is useful information to investigate.
Read the supplied record
All records below are fictional. The review date is Day 30.
| Evidence | Supplied source relationship |
|---|---|
| E1 | Day 1 certificate archive mentions the Events name |
| E2 | Day 20 spreadsheet copies that exact E1 observation |
| E3 | Day 28 service owner confirms the name remains assigned to Events |
E1 establishes a historical certificate observation. E2 makes it easier to find but adds no independent observation. E3 supports current administrative assignment through an identified owner; it does not establish that the application was reachable or correctly authorized on Day 30.
Preserve each record’s collection date and the date of the underlying event. A spreadsheet exported on Day 20 can contain a Day 1 fact. Labeling its contents “verified Day 20” would hide that distinction. A useful conclusion is: “Name observed in the certificate archive on Day 1; assignment confirmed by its owner on Day 28; current service behavior unverified.” This keeps uncertainty visible without discarding valid evidence.
The key distinction: Evidence has provenance and a scope of what it proves.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
How should the reviewer describe E1 and E2?
Show the answer
Correct answer: Two copies of one historical observation, with their shared source retained. This avoids counting duplication as independent corroboration while preserving useful provenance.
Try it
- WriteWrite a provenance note for E1-E3: source, date, claim supported, and relationship to the other records. Identify what remains unknown about current operation.