Mislukte meting telt als schoon resultaat
Een meting die niet werkte, wordt gerapporteerd als een onderwerp dat niets doet.
- Familie
- Methode
- Status
- actief
- Geldt voor
- web, mobile-app, iot, firmware
Wat er gebeurt
A capture produces little or no traffic and the conclusion drawn is that the subject collects little or nothing. In fact the run failed: the interception was refused by a pinned connection, the environment was detected, the session was too short, the page never rendered its heavier components because too many captures ran at once, or the traffic arrived but no request bodies were readable. Nothing distinguishes an empty result from a clean subject unless validity is established separately from content.
Waarom het ertoe doet
The party that ends up described as clean may be anything but. A false negative is published as reassurance, and reassurance is harder to withdraw than an accusation. It also breaks comparison: a set in which some runs failed silently ranks the subjects by how well they were measured rather than by what they do.
Veelvoorkomende oorzaken
- many captures run in parallel, starving the heavier components so they never execute
- interception blocked on exactly the channel that carries the sensitive payload, while other channels decrypt normally
- a capture from an address the subject treats differently, so a different version of the subject was measured
- a session that ends before behaviour that fires on scroll, on login or after a delay
- an extraction pattern narrower than the field names in use, so present values are counted as absent
Dit is het níet
A subject that genuinely does nothing observable is a negative finding worth publishing. This entry is about the step before it: whether the run was capable of showing the thing it reports as absent.
Hoe je het vaststelt
Indicator
A control run of the same subject, in isolation and with the same behaviour performed, produces traffic that the original run does not. Alternatively the capture itself fails a validity check: components present in the delivered code produced no traffic at all, or the capture contains flows but no readable request bodies.
Methode
differential
Kwaliteit van de detectie
90 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- A control run in isolation produces the same empty result.machinaal te toetsende bevinding vervaltThe negative then stands, and it stands much more strongly for having been tested.
- The run passed an explicit validity check recorded at the time.machinaal te toetsende bevinding vervalt
- The subject is known to behave differently for the measurement environment, and that was recorded.met de hand te toetsende bevinding wordt zwakkerRecording it converts a false negative into a stated limit, which is a legitimate finding.
- The absence claimed is about a behaviour that had never been observed in the subject even when measurement worked.met de hand te toetsende bevinding wordt zwakkerEstablish how often it occurred while present before claiming it stopped. A behaviour that fires in half of sessions needs several runs before a single clean one means anything.
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Veelgehoorde tegenwerpingen
We measured and found nothing.
Say how many valid runs that was, and what would have shown up had it been there. A count over valid runs is a finding; 'nothing seen' is not.
The scan is automated, so it is consistent.
Consistent failure is still failure. Automation makes an invalid run cheap to repeat, which is how a whole set acquires the same blind spot.
The subject cleaned up after our questions.
Possibly, and that is worth establishing properly: compare against the party's own machine-readable configuration rather than against the absence of traffic in one run.
Geldt wanneer
to-a-finding