Skip to main content

Secret rotation and telemetry evidence — assessment

Score 0 absent/incorrect, 1 prompted/incomplete, 2 independently supported with explicit limits, 3 justified fresh transfer. Every category requires at least 2; a high average cannot hide a missing category.

Required evidence​

  • SO1 — Threat/control: Retain original threat model and three implemented controls with allowed and denied cases.
  • SO2 — Rotation: Show all consumers adopting new credentials, bounded overlap and old-value revocation with positive controls.
  • SO3 — Minimization: Test synthetic sensitive sentinels across source, processor and sink while preserving useful correlation.
  • SO4 — Telemetry health: Inject collector loss and demonstrate detection, explicit coverage gaps and recovery behavior.
  • SO5 — Incident: Retain real latency fault, SLO alert, runbook execution and post-repair user-path checks.
  • SO6 — Evidence hygiene: Document retention/access, sampling/cardinality limits, tool versions and no secret values in the portfolio.

Calibration​

Denying both old and new credentials does not prove safe rotation. A redacted top-level password field is insufficient when the same value remains in a URL or exception. An empty dashboard during collection failure is unknown service health, not a clean SLO. A synthetic sentinel test establishes only the tested paths and values.

Delayed transfer and integrity​

After at least 48 hours, have a reviewer change one assumption or select a previously unseen failure. Predict the outcome, collect fresh evidence and explain discrepancies without the calibration text. Preserve mistakes, repairs, collaboration and generated-assistance disclosures. Record unavailable tools or reviewers as pending evidence, never fabricated completion. Author reference checks are not learner runtime experiments.