Detection and accountability

Why does prevention fail silently, and why is detection the only control that makes others falsifiable?

Everything so far is preventive, and prevention has one fatal property: it fails silently. A wrong grant produces no error. An over-privileged service account works perfectly. A control that has never been tested looks exactly like a control that does not work.

Detection is the only control that makes the others falsifiable (able to be shown wrong). Its mechanisms:

Audit logging with a security requirement: non-repudiation. The log must be tamper-evident and written where the actor cannot edit it. This separates it from ordinary provenance (where data came from) and operational logs (what the system did).
Access review, the forcing function against the decay of controls.
Anomaly detection on read volume and pattern. It is the only thing that catches an authorized insider.
Deliberate verification: try the access that you believe is denied, and confirm that it is denied.

The honest limit: detection happens after the fact. It turns an unbounded loss into a bounded one, and its value is entirely in the time to detect. A log nobody reads has a time to detect of infinity and so is worth nothing, which is the most common state of security logging in practice. In Wei's review the time to detect was 11 weeks.

Case, resolvedConstructed case · Wei at Hollis Health

Exposed for 11 weeks, and every control green

A departed contractor's live account copied 2.3 million billing rows, a result cache keyed on query text served one department's rows to another, and nothing noticed for 11 weeks. Where it started: Where it breaks →

The departed contractor and the USB drive. Wei cannot stop an authorized read, so she moves to the missing surfaces. Accounts are now derived from the HR system and expire after 90 days without re-attestation. Exports of more than 10,000 rows from the BI tool require a second approver (two-person control, narrowly applied), and USB mass storage is blocked on finance laptops. The read volume of 2.3 million billing rows would also now raise an alert (anomaly detection).
The shared cache. The cache key now includes the user's roles and the policy version. A test run deliberately tries to read another department's cached result and checks that it is denied (deliberate verification). Anything shared between tenants is treated as a channel.
The 11 weeks. The audit log is written to a store the data team cannot edit, with hash chaining. Ingrid sets a target time to detect of less than 24 hours for bulk reads, and measures it with a monthly test.
Others on the list. The nightly pipeline now has one workload identity per pipeline instead of one shared account. A break-glass role exists, self-service, loud and valid for two hours. The decision cache TTL is 5 minutes, and Wei writes that number as the revocation SLA. Residency is handled by keeping all patient data in one region and one cloud account owned by Hollis, since encryption alone would not answer the regulator.

Wei's table, "control x adversary", now has five columns, and for the first time it also has a row called "how do we find out it failed?"