A derived allow-list goes live and leadership wants the plant declared segmented - what do you refuse to claim, given an intruder may have been inside the learning window?
answer
- match the claim to the evidence you have
- denied what was absent, not permitted what is authorised
- three lists: defensible, refused, conditional
- price each upgrade rather than argue wording
- documentation as a commissioning deliverable
basics
~20 sRefuse to say that permitted equals authorised, that every conduit has a purpose, or that lateral movement is prevented. Claim only that traffic absent from the window is denied, and price what a stronger claim would cost.
solid answer
~50 sThe claim has to match the evidence. What you have is a policy compiled from observed traffic plus partial human attribution, so the defensible statements are: unobserved traffic is now denied, a new foothold is constrained, dependencies are enumerated, and a stated fraction of boundary-crossing permits has a named owner. The statements you refuse are the ones leadership actually wants - that permitted equals authorised, that each conduit has a documented purpose, and that anyone already inside is now contained - because a resident adversary's sessions were learned along with everything else. Then say what upgrading the claim costs: an assurance activity to establish the estate's state before the baseline is trusted, and a contractual change so the next integrator delivers an interface specification at commissioning rather than leaving you to reconstruct intent afterwards. Both are procurement decisions, not engineering ones, and they belong to whoever signs the report.
go deeper
Know that enforcing a derived allow-list narrows a network but does not mean anyone reviewed the traffic it permits, so the wording of any claim matters.
Be able to state the narrow true claim - traffic absent from the observation window is denied - and to explain why the broader claims do not follow from it.
Show you would attach coverage numbers to the claim and route unexplained permits to a register rather than letting a project closure imply they were reviewed.
Own the trade with the sponsor: name the refused claims, price each upgrade, and take the contractual route by making interface documentation a commissioning deliverable.
## Why this is a leadership question, not a technical one Everything technical is already decided: the flows were observed, the list was compiled, the rules are enforced. What remains is what the organisation is allowed to *say*, and to whom - a board pack, an insurer, a customer questionnaire, an auditor, a regulator in some sectors. Overstating here is not a rhetorical sin; it removes the pressure that would otherwise fund the next step, and it puts a signature under a sentence the evidence does not support. ## Separate the claims into three lists **Defensible.** State these plainly and precisely. - Traffic not present during the observation window is now denied at the zone boundary. - A newly established foothold is constrained to paths that were already in use. - The estate's dependencies are enumerated for the first time, as N permits across M patterns. - Intent has been attributed for a stated share of boundary-crossing permits, each with a named owner. **Refused.** These are the sentences leadership will reach for. - "Only authorised traffic is permitted." Authorisation was never observed; permits describe what ran. - "Every conduit has a documented purpose." Purpose exists only where the attribution campaign reached, and it did not reach everything. - "Lateral movement is prevented." An adversary resident during the window holds permitted paths, and widened rules may cover their neighbours too. - "The plant meets the intent of a zone-and-conduit model." Those models ask what each conduit is *for*; a derived list cannot answer that by construction. **Conditional.** Claimable only after something is bought - which is the useful part of the conversation. ## Price the upgrade instead of arguing about the wording Walking in with a refusal alone gets you overruled. Walk in with the cost of each stronger claim: | Claim leadership wants | What has to be bought first | | --- | --- | | No adversary is inside the permitted set | An assurance activity that establishes the estate's state, run before the baseline is treated as truth | | Every conduit has a stated purpose | Attribution effort, in engineer-weeks, plus plant-team time you do not control | | Purposes stay documented as the plant changes | An interface specification as a commissioning deliverable in the next integrator contract | | Unexplained permits shrink over time | An outage budget and a maintenance window signed by the production owner | The third row is the durable fix and the one most often missed. The reason intent is unavailable is that nobody was ever obliged to write it down. Reconstructing it after the fact is expensive and partial; requiring it as a deliverable at commissioning is cheap and complete, and it is a procurement change rather than an engineering one. A security function that only ever reconstructs will reconstruct forever. ## Put the residual risk where it can be accepted The unattributable permits are a risk somebody must own, and it should not be the engineer who ran the project. Each goes into the plant's own risk register with an honest sentence - *this permit exists because it was observed and nobody can state its purpose* - and an accepting owner who has the authority to accept it. That does three things: it makes the exposure visible to the person who can fund its removal, it gives a later reviewer permission to act, and it stops the derived list from being read, years on, as a designed policy. ## What to do when you are overruled Sometimes the report says "segmented" anyway. Then write the qualification down where it survives - in the risk register entry, in the project closure record, in the assumption log - so the claim and its basis are stored together. The point is not to win the wording; it is to ensure that when someone later asks how an intruder held a permitted path for two years, the answer is a documented assumption rather than a discovered surprise. ## How to answer this in an interview Show that you distinguish evidence from assertion, that you can state a narrower true claim confidently rather than sulking about the wider false one, that you price the upgrade, and that you route residual risk to an owner with authority. Naming the contractual lever - documentation as a commissioning deliverable - is what separates a principal answer from a very good senior one.
- Leadership says the distinction is academic because the network is far tighter than last month. What do you say?Agree with the premise and hold the wording. It is genuinely tighter, and that claim should be made loudly. The distinction stops being academic the moment the report is used as assurance - for an insurer, a customer questionnaire or a board risk decision - because those readers act as though permitted traffic has been reviewed. Keep the true claim and attach the price of the stronger one.
- Who should own the unattributable permits after the project closes?The accountable production owner for the assets involved, recorded in the plant's own risk register, not the security engineer who generated the list. They are the party who can weigh an outage against an unexplained permit and the one who can fund the attribution or the change that removes it. Security owns the register's accuracy and the review cadence, not the acceptance.
saying these in an interview costs you the question
- Reports the plant as segmented on the strength of enforcement alone
- Treats a derived permit set as a documented design
- Leaves residual permits owned by the security team
- Refuses the wording without pricing a stronger claim
- Plans to reconstruct intent again next year instead of contracting for it