jperezduerto.info
Security in depth · Unit 18 · Lesson 8 of 8
Separate unknown from absent
Apply explicit evidence rules to fresh, stale, and retired inventory records.
Helpful before thisReconnaissance: building an evidence-based map
After this lesson you can
- Assign different statuses to missing reports when the supporting retirement evidence differs.
One idea. One situation. One reasoned decision.
How it works
An inventory can distinguish observed, corroborated, stale, and unresolved information. Missing data does not automatically mean that an asset or control is absent. Conversely, a recorded control does not prove active coverage. Define confidence labels by evidence requirements so two reviewers use them consistently. Focus follow-up work on uncertainties that could change a decision rather than filling every field for appearance.
Read the supplied record
On fictional Day 30, the inventory team defines “recent report” as collected within seven days. “Retired” requires a completed owner-approved retirement record tied to the exact asset identifier.
| Asset | Management report | Other evidence |
|---|---|---|
| A | Last received Day 4 | Matching retirement record completed Day 28 |
| B | Last received Day 4 | No retirement record supplied |
| C | Received Day 29 | No retirement record supplied |
A meets the stated retirement rule. B is stale and unresolved: an offline device, collection problem, changed identifier, or undocumented retirement could explain its silence. C has a recent report, but that fact alone does not establish patch compliance or complete monitoring.
Prioritize B’s follow-up through the responsible asset or management owner, retaining the last observation instead of deleting the row. Ask for evidence that distinguishes the plausible states. Confidence labels should summarize defined evidence requirements and remain revisable. They are not a numerical certainty score, and missing data should not quietly turn into “absent,” “safe,” or “retired.”
The key distinction: Absence of a report is an observation with multiple possible causes.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which classification follows the supplied evidence rules?
Show the answer
Correct answer: A has documented retirement; B is stale and unresolved; C has a recent report with limited scope. Each status follows its own evidence requirement rather than turning silence or freshness into a broader guarantee.
Try it
- WriteAssign a supported status to A, B, and C. For B, name the next evidence source; for C, name one control claim a recent report does not establish.