jperezduerto.info
Security in depth · Unit 30 · Lesson 4 of 11
A clean result has a coverage boundary
Use a coverage matrix without turning a clean sample into a security guarantee.
Helpful before thisReporting: turn evidence into useful improvements
After this lesson you can
- Calculate reviewed role-workflow combinations and write a bounded negative finding.
A useful “nothing found” statement says exactly where the team looked.
Define the population first
Assessment coverage describes systems, conditions, and behaviors actually examined. A count needs a denominator defined before interpreting results. Even complete coverage of a checklist does not guarantee that the checklist contains every relevant behavior or failure condition.
Assume a fictional policy review plans four workflows for each of three roles: Viewer, Editor, and Administrator. That creates twelve role-workflow combinations. The exercise uses release 4.2 in staging; production configuration is not included.
Supplied coverage matrix
- S1: All four Viewer combinations were reviewed against the approved policy.
- S2: Two Editor combinations were reviewed. The other two and all four Administrator combinations were excluded because the evidence was unavailable.
- S3: No policy deviation was found in the six reviewed combinations under the documented conditions.
State the result without stretching it
The team reviewed six of twelve planned combinations: 50% of this defined inventory. That does not mean the application is “50% secure.” Different combinations can have very different business consequences, and this count does not weight their importance.
S3 supports a bounded negative finding for release 4.2 in staging. It does not establish production behavior, Administrator permissions, or results after another release. Record the unavailable evidence and a responsible follow-up rather than quietly removing those cases from the plan.
If scope changes, preserve the earlier denominator and explain the new one. Otherwise an apparent coverage improvement could result from deleting hard-to-review cases.
Model conclusion: No deviation observed in six specified staging combinations. Six planned combinations and production remain unassessed.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which conclusion matches S1-S3?
Show the answer
Correct answer: Six of twelve planned role-workflow combinations were reviewed without a deviation under the supplied conditions. This states the counted coverage and the observed result while leaving excluded roles, workflows, and production outside the conclusion.
Try it
- WriteWrite a coverage statement naming release, environment, six reviewed combinations, six exclusions, and the limit of the clean result. Do not describe 50% coverage as 50% security.