What decides the retention of a secret store's access record, given that exposures often surface a year after the fact?
answer
- detection lag, not operational usefulness
- the fallback is over-replacement and over-notification
- the negative claim needs coverage
- a long record is a map worth stealing
- test a question at the far end
basics
~20 sThe longest realistic lag between a credential escaping and anyone noticing, plus the span of outside questions you must answer. Against that: a long-kept record maps which identity reads which credential, so protect it in step.
solid answer
~40 sSet the window from **detection lag**, not from operational usefulness. Credential exposures routinely surface months later — a copy found in an old artefact, a notification from a third party, an external review asking who read one value between two dates — and a record that has already expired cannot bound what the exposure reached. The cost of the missing record is paid as over-replacement and over-notification: you replace everything that identity could reach and tell everyone who might be affected. Two counterweights shape the decision. The record itself becomes an intelligence asset the longer it is kept, since it maps which identity reads which credential and when. And identifiers must survive the window — display names get reassigned, so an entry from fourteen months ago has to still resolve.
go deeper
Remember that the record is read long after it is written, so how long it is kept is a decision about answering questions later, not about disk.
Explain what the record has to answer months later and why an expired window forces you to assume the worst about who read the value.
Show the operating discipline: measure your own detection lag, keep identifiers that still resolve at the far end, and rehearse a boundary-date query rather than trusting the setting.
Own the trade-off in both directions — retention against the cost of over-replacement and over-notification, and against the fact that a years-long record is itself a map of the estate's credential access.
## The window is set by detection lag, not by usefulness The instinct is to retain an access record for as long as it is being used, which for most estates means weeks. That is the wrong input entirely. The record is not consumed day to day; it is consumed once, long afterwards, when someone asks a question that only it can answer. So the input is **how late exposures actually surface here** — and the honest answer in most estates is months, sometimes more than a year. A credential is found in an old build artefact. A partner reports seeing one. An external review three months after a departure asks which identities read a reporting warehouse's database credential between two dates. Write that lag down from your own history rather than assuming it. If the last five credential exposures surfaced at three, seven, nine, eleven and fourteen months, a ninety-day record answers none of them. ## What you pay when the window has already elapsed The record does not merely go missing; its absence converts directly into work and into risk: 1. **The scope inflates to the maximum.** Unable to say who read the value, you must assume every identity that held the grant did, and treat everything that grant reached as exposed. 2. **Replacement becomes estate-wide instead of targeted.** Rather than replacing what the identified readers touched, you replace everything reachable, which is the expensive and outage-prone version of the same operation. 3. **Notification becomes broad instead of specific.** You tell everyone who might be affected because you cannot produce the list of who was. 4. **The negative claim is unavailable.** "No other identity read this" is the statement most reviews actually want, and it cannot be made from a record that no longer covers the period. So retention is bought against the fallback you would otherwise pay. That framing also tells you when a short window is defensible: where the fallback is genuinely cheap, because every credential under that name is generated per consumer and replacing them all is routine. ## The record becomes worth stealing A counterweight that is often missed. A complete access record kept for years is a map: which identities read which credentials, how often, from where, and which branches of the name space exist at all. It contains no credential values — that rule does not bend — and it is still one of the more useful documents in the estate for anyone planning a targeted attempt. Retention therefore raises the record's own protection requirement in step: where it is held, how it is protected, and how long a copy of a copy may live. Who may read it at all is a separate decision with its own owner, but the longer the window, the more that decision is worth revisiting. ## Identifiers have to survive the window A record is only retained if it is still *readable* at the far end. - **Display names get reassigned.** A team name, a service name or a human's label may point at something different fourteen months later, or at nothing. - **Name spaces get reorganised.** The branch a value sat under may not exist any more, so the entry has to carry an identifier for the value rather than only its position. - **The rule that allowed a read may be long gone**, which is exactly why the entry names it: it dates the grant even after the grant is withdrawn. - **Schema drift.** Entries written years apart must still be queryable together, so fields are added rather than repurposed. ## Deciding, and then testing the decision - Set the window from the longest realistic detection lag for the exposure classes you actually see, and from the span of outside questions you must be able to answer. - Where holding the full entry that long is not workable, decide explicitly which reduced entry stays answerable — identity, value name, version, operation, outcome, timestamp — rather than letting the truncation happen by default. - **Test it by asking a question at the far end**, on a schedule: pick a value, pick two dates near the boundary, and try to produce the list of identities. A retention setting nobody has exercised is a claim, not a capability. - Revisit it after every exposure, using the lag you just measured rather than the one you assumed. Stores differ in how long they keep their own record and whether they keep one at all; treat the store's own setting as a floor to be replaced by the shipped copy's window, because the long-window decision belongs to wherever the record lands, not to the store.
- A credential's exposure surfaces at fourteen months and the record covers ninety days. What do you actually do?You stop trying to scope it and pay the fallback: treat everything the grant could reach as exposed, replace it, and notify on the broad assumption rather than the narrow fact. Then record the measured lag — fourteen months — and set the window from it, because the next one will surface on a similar clock.
- Can a shorter window ever be the right answer?Yes, where the fallback is cheap. If every credential under that name is generated per consumer and short-lived, replacing them all is a routine operation rather than an outage, so the record buys less. The decision is the cost of the fallback against the cost and sensitivity of the retention, not a fixed number.
saying these in an interview costs you the question
- Setting the window from what operations finds useful day to day
- Assuming an exposure will surface inside the window
- Calling the record harmless because it holds no credential values
- Keeping display names that get reassigned within the window
- Never testing a question at the far end of the window