The assumptions nobody owns

Why are the field's weak points one group, and why do controls that are all green still leave data exposed?

CaseConstructed case · Wei at Hollis Health

Exposed for 11 weeks, and every control green

Eleven weeks after the extract incident, Hollis finds out, from a patient's complaint, that the records of a clinic's patients were visible outside the clinic's team. The post-incident review finds three separate faults, all at once:

A departed finance contractor's account still existed and was used. He had read 2.3 million billing rows through his old, valid access and then copied them to a USB drive. No rule was broken at the access-control layer.
A developer's result cache in the SQL engine stored query results under a key made only of the query text. Two users in different departments ran the same query text and the second one received the first one's rows.
Nobody noticed any of this for 11 weeks. No alert fired. The only log existed, but nobody read it.

Every control on Wei's table was green. This article explains why: the first-order mechanisms are the ones people design, and the assumptions underneath them are the ones nobody owns.

How it ends →

Why these weak points are one group, not six

Each weak point in this article is a place where the three control surfaces assume something that they do not enforce:

Access control assumes the chokepoint is narrow. Egress and multi-tenancy are where it is not.
Access control assumes the set of principals is accurate. Account lifecycle and service accounts are where it is not.
Protection assumes the key holder is the only party who can force access. Custody and residency are where that is false.
All three are preventive, so all three fail silently. Detection is the missing fourth surface.

These are not footnotes. They are where security breaks in the field, and the reason is the same each time: the first-order mechanisms are the ones people design, and the assumptions underneath them are the ones nobody owns.